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Revisable Justified Belief: Preliminary Report 
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Abstract 

The theory CDL of Conditional Doxastic Logic is the single-agent version of Board’s multi-agent theory 
BRSIC of conditional belief. CDL may be viewed as a version of AGM belief revision theory in which 
Boolean combinations of revisions are expressible in the language. We introduce a theory JCDL of Justified 
Conditional Doxastic Logic that replaces conditional belief formulas B’^ip by expressions t'fiip made up 
of a term t whose syntactic structure suggests a derivation of the belief y after revision by ip. This allows 
us to think of terms t as reasons justifying a belief in various formulas after a revision takes place. We 
show that JCDL-theorems are the exact analogs of CDL-theorems, and that this result holds the other way 
around as well. This allows us to think of JCDL as a theory of revisable justified belief. 


1 Introduction 

Conditional Doxastic Logic is Baltag and Smets’ [1] name for a single-agent version of Board’s [5] multi-agent 
theory of conditional belief BRSIC. CDL has formulas to express that the agent believes ip conditional 
on Ip. As we will see, CDL has a certain relationship with the “AGM theory” of belief revision due to due to 
Alchourron, Gardenfors, and Makinson [T]. So we may also think of B^ip as say that the agent will believe 
ip after revising her belief state by successfully incorporating the information that ip is true. As with AGM 
theory, CDL assumes that conditionalization (i.e., revision) is always successful: the agent is to assume that 
the incoming information ip is completely trustworthy and therefore update her belief state by consistently 
incorporating this incoming information. If before the revision she holds beliefs that imply -i^, then she 
must give up these beliefs so that she will come to believe ip after the revision takes place. The question 
then is how to do this in general. 

The models of CDL are “plausibility models.” These are very close to Grove’s “system of spheres” for 
AGM theory [6j. As we will see, we can view the conditionalization/revision process either from the semantic 
perspective, as a dehnite operation on plausibility models, or from the syntactic perspective, as an axiomatic 
formulation analogous to the postulate-based approach of AGM. However, it is perhaps simplest to start 
with the semantic perspective. 


2 Plausibility models 

Definition 2.1 (Plausibility models). Let be a set of propositional letters. A plausibility model is a 
structure M = {W,<,V) consisting of a nonempty set W of “worlds,” a preorder (i.e., a reflexive and 
transitive binary relation) < on W, and a propositional valuation V : W ^ p(=^) mapping each world w to 
the set V{w) of propositional letters true at w. We call < a plausibility relation on W. In terms of <, we 
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define the converse relation >, the strict version <, the strict converse relation >, and the various negations 
of these (denoted by writing a slash through the symbol to be negated) as usual. ~ denotes the relation 
~ := (> n <) of equi-plausibility. A pointed plausibility model is a pair {M,w) consisting of a plausibility 
model M and the point w, itself a world in M. Notation: for each w G W, we define the set 

:= {x € W \ X < w} . 

X < y read, “x is no less plausible than y.” According to this reading, if we think of < as a “less than 
or equal to” relation, then it is the “lesser” elements that are more plausible. Therefore, if < is a well-order 
and 5 is a nonempty set of worlds, min S is the set of worlds that are the most plausble in S. While it may 
at first seem counterintuitive to the uninitiated, this convention of “lesser is more plausible” is nevertheless 
standard in Belief Revision Theory]^ 

We think of the plausibility relation as describing the judgments of an unnamed agent: for each pair 
of worlds (x, y), she either judges one world to be more plausible than the other or the two to be of equal 
plausibility. Plausibility models for multiple agents have a number of plausibility relations, one for each 
agent. For present purposes, we restrict attention to the single-agent case, though we say more about the 
multi-agent situation later. 

Definition 2.2 (Plausibility model terminology). Let M = (kP, <, P) be a plausibility model. 

• To say M is finite means W is finite. 

• To say M is connected means that for each x G W, we have cc(x) = W, where 

cc(x) := {y G X I x(> U <)’''y} 

is the connected component of x and (>U<)+ is the transitive closure of >U<j^ A connected component 
is a subset 5 C VP for which there exists an x G VP such that cc(x) = S. 

• To say M is well-founded means < is well-founded: for each nonempty S C VP, the set 

min S '■= {x € S \ yy £ S : y x} 
of minimal elements of S is nonempty. 

• To say that a set 5 C VP of worlds is smooth in M means that for each world x G S', either x G min(S) 
or there exists y G min(S) such that y < x. Given a collection P C p(VP) of sets of worlds, to say 
that M is smooth with respect to T means that every S G T is smooth in M. To say that M is smooth 
means that M is smooth with respect to p(VP). 

• To say that M is total means that < is total on VP: for each (x, y) G VP x VP, we have x < y or y < x. 

• To say M is well-ordered (equivalently, that M is a well-order) means that < is well-ordered (i.e., it 
is total and well-founded). 

• To say that M is locally total means that < is total on each connected component: for each u; G VP 
and (x, y) G cc{w) x cc{w), we have x < y or y < x. 

^This convention stems from the notion of “Grove spheres” [S]: given a well-order, worlds are arranged so that they sit on 
the surface of a number of concentric spheres. Worlds of strictly greater plausibility are assigned to spheres with strictly shorter 
radii, and equi-plausible worlds are assigned to the same sphere. In this way, the most plausible worlds sit on the surface of the 
innermost sphere, which has the minimum radius. Similarly, if we restrict attention to a nonempty set S of worlds, then we 
“recenter” the sphere around S. By this we mean that we create a new system of spheres consisting of just those worlds in S. 
After doing so, the most plausible worlds again sit on the surface of the innermost sphere, which again has the minimum radius. 

^The transitive closure of a binary relation R is the smallest extension 3 R satisfying the property that xR'^y and yR^z 
together imply xR'^z. 
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• To say M is locally well-ordered (equivalently, that M is a local well-order) means that < is locally 
well-ordered (i.e., it is well-founded and total on each connected component). 

To say that a pointed plausibility model (M, w) satisfies one of the model-applicable adjectives above means 
that M itself satisfies the adjective in question. 

Theorem 2.3 (Relationships between terminology). Let M = (IT, <, T) be a plausibility model and S C W. 

1. If M is hnite, then M is well-founded. 

2. If M is locally well-ordered, and 5 is a connected component, then 

min S' = {x G 5 I Vy G 5 : X < y} . 

3. If M is well-ordered, then minS = {xGS|VyGS;x< y}. 

4. M is well-founded iff M is smooth. 

5. M is well-ordered iff M is smooth and total. 

6. M is locally well-ordered iff M is smooth and locally total. 

Proof. See the appendix. □ 

From now on, in this paper we will restrict ourselves to locally well-ordered plausibility models, unless 
otherwise specihed. 

3 Conditional Doxastic Logic 

3.1 Language and semantics 

Definition 3.1 (J^cdl)- Let ^ be a fixed set of propositional letters. The language of Conditional Doxastic 
Logic consists of the set of .F^cdl formulas (p formed by the following grammar: 

ip L \ p \ {ip ^ if) \ B^p p ^ PP 

The logical constant T (for truth) and the various familiar Boolean connectives are defined by the usual 
abbreviations. Other important abbreviations; denotes B'^p, and Bp denotes B'^p. 

The formula B'^p is read, “Conditional on ip, the agent believes p.” Intuitively, this means that each of 
the most plausible '0-worlds satisfies p. The forthcoming semantics will clarify this further. The basic idea 
is that a belief conditional on 0 is a belief the agent would hold were she to minimally revise her beliefs so 
that she comes to believe 0. 

Definition 3.2 (.ifcDL-truth). Let M = (VT, <,T) be a locally well-ordered plausibility model. We define 
a binary satisfaction relation |= between locally well-ordered pointed plausibility models (M, w) (written 
without surrounding parentheses) and .ifcDL-formulas and we dehne a function [[—]] : .ifcDL —^ p{W) as 
follows. 

• \p\m := {u G it I M,v 1= p}. The subscript M may be suppressed. 

• M,w ^ ±. 

• M, w \= p iS p £ V(w) for p G 
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• M, u; 1= — )> '0 iff M, w (p or M, w |= V’- 

• M, If; 1= iff for all x G cc(rt;), we have 

X'*' n [[V^]] =0 or G X'*' n [V’l : ?/'*' n [V’l C [[(^J . 


B'^p holds at w iff for every world connected to w that has an equally or more plausible ;/;-world y, 
the -f/f-worlds that are equally or more plausible than y satisfy p. 

We extend the above so that we may have sets S C .ifcDL of formulas on the right-hand side: 

M, re 1= 5 means M, w \= p for each p G S . 

Also, we will have occasion to use the following notion of local consequence: given a set 5 U {p} C ^cdl of 
formulas and writing ip* to denote the class of pointed plausibility models, 

S |=£ p means V(M, re) G : M, re ^ 5 implies M, w \= p . 

Finally, we write M \= p to mean that M, v \= p for each world x in M (“<y9 is valid within M”). 

Remark 3.3 (Knowledge). Baltag and Smets [1] read the abbreviation 

Kp := B^'^1. 


as “the agent knows p.’’’’ This notion of “knowledge” is based on the rejection of a proposed belief revision. 
In particular, Kp = B^^l. says that the most plausible -it/p-worlds are T-worlds. The propositional constant 
T for falsehood is true nowhere, so this amounts to us saying that the agent does not consider any -k^- worlds 
possible. Hence all the worlds she considers possible are (/9-worlds. It is in this sense that we say she “knows” 
that p is true: she will not revise her beliefs by ^p (on pain of contradiction). It is easy to see that the 
semantics ensures that K so-defined is an S5 modal operator: knowledge is closed under classical implication, 
what is known is true, it is known what is known, it is known what is not known, and all validities are known. 


In well-founded plausibility models, belief in p conditional on ■0 is equivalent to having p true at the 
most plausible ^’-worlds that are within the connected component of the actual world. And if the models 
are well-ordered, then we can omit mention of the connected component. 


Theorem 3.4 (.ifcDL-Kuth in well-founded models). Let M = (IT, <, T) be a plausibility model. 

(a) If M is well-founded: M,w |= B'^p min|{;/i]] n cc(x;) C [[(/jJ. 

(b) If M is well-ordered: M,w ^ B'^p min|{V;]] C 

Proof. See the appendix for the proof of Q. For Q, if M is well-ordered, then < is total and therefore 
cc{w) = IT for each rx G IT. Apply 0. □ 

The intended models for CDL are the well-ordered (and hence well-founded) plausibility models. 


Definition 3.5 (.jSfcDL-validity). To say that a .^fcDL-formula p is valid, written |= p, means that we have 
M \= p for each well-ordered plausibility model M. 


As per Theorem 3.4, restricting validity to the well-orders allows us to read B'^p as follows: “the most 
plausible ^’-worlds satisfy (/9.” While the intended models for CDL are well-ordered, and validity is defined 
accordingly (as per Definition 3.5), the following theorem shows that locally well-ordered plausibility models 
would suffice. 
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Axiom Schemes 


(CL) 

Schemes 

i for Classical Propositional Logic 

(K) 

B^ipi - 

-G P2) ^ {B^pi ^ B^P2) 

(Succ) 

B^fj 


(lEa) 

B^p^ 

(R^^^x GG B^x) 

(lEb) 


-£ {B^^^x^ B^ip^x)) 

(PI) 

B^X^ 

B'^B^X 

(NI) 

^B^X- 

£ B'^^B^X 

(WCon) 




—>■ V’ A 

1 p 


Rules 


(MP) 






■(MN) 


i/) <-)■ ?/)' 




^ B^'ip 


(LE) 


Table 1. The theory CDLo, a single-agent variant of Board’s theory BRSIC [5] 


Theorem 3.6 (.ifcDL-validity with respect to local well-orders). Let be the class of locally well-ordered 
plausibility models. For each ip G .i^cDLi we have: 

'^if iff VM G M 1= . 

Proof. Right to left (“if”): obvious. Left to right (“only if”): assume \= ip and take M = {W, <,R) G 
and a world w G W. Let M' be the sub-model of M = (VF', <', V') obtained by restricting to cc{w): 

W' = cc(w), <'=< n{W' X W'), V'{v) = V{v) for v G W'. 

Since M G it follows that M' is well-ordered and therefore, since |= p, we have M',w ^ p. It follows 
by a straightforward induction on the construction of .J^cDL-formulas 9 that M', tc |= 0 iff M, w \= 6. 
Hence M, w \= p. Since w ^ W and M G were chosen arbitrarily, we conclude that M \= p for each 
Mg^Il. □ 

3.2 Board’s theory BRSIC and CDLq 

The Hilbert theory of Conditional Doxastic Logic was first studied by Board [5] under the name BRSIC. 
Baltag and Smets [3j subsequently developed various alternative axiomatizations and extensions and intro¬ 
duced the name Conditional Doxastic Logic. The single-agent version of Board’s theory BRSIC is equivalent 
to what we call CDLq. 

Definition 3.7 (CDLq theory). CDLq is defined in Table 

CDLo is actually a simplification of BRSIC. In particular, BRSIC is a multi-agent theory for a nonempty 
set A of agents using a language similar to .i^cDL except that it has as primitives both conditional belief 
Btp for each agent a £ A and unconditional belief BaP for each agent a £ A. Since the BRSIC axiom 
BaP o- B]^p (“Triv”) requires that unconditional belief be equivalent to conditional belief based on a 
tautological conditional, we have decided upon a streamlined language that contains conditional belief only. 
This allowed us to define away Board’s axiom Triv in the following way (in Definition |3.1[ ): let BaP abbreviate 
Bjp. We have also renamed some of Board’s axioms and rules: his Taut is now called (CL), his Dist is 
now called (K), his IE(a) is now called (lEa), his IE(b) is now called (lEb), his TPI is now called (PI), his 
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NPI is now called (NI), his RE is now called (MN), and all of his other axiom names have been enclosed in 
parenthesis. Finally, what we call (WCon) is the contrapositive of what Board called WCon. Restricting to 
a single-agent setting and thereby dropping subscripted agent names, we obtain the theory CDLq. 


Remark 3.8 (Multi-agent CDLq). A multi-agent version of CDLq is obtained by making trivial modifications 
to the language, axiomatization, and semantics of CDLq. In particular, for a nonempty set A of agents, the 
multi-agent language is like the single-agent language .J^cdl except that each conditional belief operator 
B'^ is replaced by a number of operators , one for each agent a G A. The multi-agent theory CDLf^ is 
obtained by adding a metavariable agent subscript a to each of the belief operators in Table The models of 
CDL^ are multi-agent plausibility models', these are like single-agent plausibility models presented above (in 
Definition 2.1) except that the preorder < is replaced by a preorder <a for each agent a G A. The definition 
of truth for on these models is like that in Definition |3.2| except that the meaning of M,w \= B^ip 

is changed so as to refer to the preorder <a. Validity is defined with respect to the class of multi-agent 
plausibility models satisfying the property that each <a is locally well-ordered. 

So, in essence, the multi-agent version consists of multiple single agent versions such that each agent’s 
conditional beliefs are always restricted to the worlds connected (for that agent) to the given world w 
currently under consideration. It is clear that restricting to one agent a yields a framework that is equivalent 
to the version of CDLq we have presented here. 

We note that the multi-agent version allows us to describe what one agent conditionally believes about 
what another agent conditionally believes. This is feature of interest in a wide variety of applications. 
However, from the technical perspective, the difference between the single- and multi-agent frameworks does 
not amount to too much in the way of mathematical shenanigans. It therefore suffices to indicate, as we have 
here, how the multi-agent version is obtained from the single-agent version and then restrict our study to the 
single-agent version. Of course, one may consult Board [5] for the fully specified account of the multi-agent 
theory BRSIC. 


3.3 The theory CDL 

It will be our task in this paper to develop a version of Conditional Doxastic Logic with justifications in 
the tradition of Justification Logic [2]. We will say more about this later, but for now it suffices to say 
that justifications in this tradition are meant to encode the individual reasoning steps that the agent uses 
to support her belief in one statement based on justifications she has for beliefs in other statements. In this 
way, justifications are supposed to present a stepwise explanation for how the agent derives complex beliefs 
from more basic ones. It is in this sense that justifications are “proof-like.” 

In order to make this precise, we require an axiomatization of Conditional Doxastic Logic that is more 
perspicious than is CDLq with regard to the ways in which conditional beliefs obtain. In particular, (lEa), 
(lEb), and (LE) are powerful principles that in fact encode a number of more basic principles and, as such, 
these powerful principles compress a number of reasoning steps into a small number of postulates. This is 
especially obvious with (LE): a belief conditional ijj may be replaced by a provably equivalent conditional ^|J' 
in one step, which does not reflect the complexity of the derivation that was used to prove the equivalence 
■0 -H- ijj'. From the point of view of the Justification Logic tradition, wherein justifications should explain 
in a stepwise fashion how one conditional belief follows from another, this is undesirable. Intuitively, if the 
agent believes y? conditional on if;, then the reason she believes (p conditional on a provably equivalent 
depends crucially on the reasoning as to why ip' is in fact equivalent to ip. If vri and a more complex 7r2 
are proofs of this equivalence, then an agent who bases her belief on the more complex 7r2 should have a 
correspondingly more complex justification witnessing her belief. We therefore require an alternative but 
equivalent axiomatization of the theory CDLq that makes such stepwise reasoning operations more explicit. 
The exact criteria we seek for such a theory are not precisely defined but are based on the authors’ experience 
in working in the Justification Logic tradition. We call the theory we have settled upon CDL, and later we 
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(CL) 

Axiom Schemes 

Schemes for Classical Propositional 

(K) 

B'^ipi ^ P2) ^ (B^Pi ^ BSp2) 

(Succ) 

B^ip 

(KM) 

BS± — > i?V'A</3_|_ 

(RM) 

-^B-^^p {B^x BS^^x) 

(Inc) 

BS^^X^B^ip^x) 

(Comm) 


(PI) 

B^x B'^B^x 

(NI) 

^B^X B^^B^x 

(WCon) 

bSl ^ip 


ip ^ Ip p 

Ip 


Rules 


(MP) 






(MN) 


Table 2. The theory CDL 


will explain how this theory gives rise to a theory of Conditional Doxastic Logic with justifications. 
Definition 3.9 (CDL theory). CDL is defined in Table 

The scheme (CL) of Classical Logic and the rule (MP) of Modus Ponens tell us that CDL is an extension 
of Classical Propositional Logic. The rule (MN) of Modal Necessitation tells us that derivable formulas hold 
in all conditional belief states. 

Scheme (K) is just Kripke’s axiom for our conditional belief operator B'^. The scheme (Succ) of Success 
says that every belief revision is always successful: if the agent revises her belief based on the information 
that ip, then she will always arrive in a belief state in which ip is one of her beliefs. 


Making use of the definition of knowledge Kp := B^'-^l. from Remark 3.3, we can look at the following 
special case of the scheme (KM) of Knowledge Monotonicity: 




Since is equivalent to ip and ^{^ip A ^p) is equivalent to pjV p, we may interpret the above instance of 
(KM) as telling us that knowledge is closed under disjunction; if ip is known, then so is V' V p. But another 
interpretation perhaps better explains the word “Monotonicity” in the name of this scheme. Returning now 
to the official formulation 

B^± 

of (KM), this scheme tells us that if we can conclude that a belief state conditional on ip is contradictory, 
then conjunctively adding any further information p yields a belief state conditional on ip /\ p that is 
still contradictory. Accordingly, the belief state is unchanged by the conjunctive addition of any further 
conditional information, and so the belief state is trivially “monotonic” in the conjunctive addition of 
conditional information. 

The scheme (RM) of Rational Monotonicity permits a more subtle kind of conjunctive addition. This 
scheme, 

^B^^p ^ {B^x ^ , 
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says that if ip is consistent with the belief state conditional on then we may conjunctively add (p to 
our conditional without losing any beliefs from the original belief state. This is a non-trivial monotonicity: 
incorporating the information (p by forming the conditional ip A (p yields a belief state that includes all the 
beliefs from the belief state conditional on but it may also include more. 

The scheme (Inc) of Inclusion says that a belief state conditional on ip includes every y implied by ^p 
whenever the belief state conditional on the conjunction ip Aip includes x- The scheme (Comm) of Commu¬ 
tativity says that the belief state conditional on a conjunction is invariant to the ordering of the conjuncts. 
The schemes (PI) of Positive Introspection and (NI) or Negative Introspection tell us that conditional beliefs 
are identical in all belief states. The scheme (WCon) of Weak Consistency tells us that belief revision is 
consistent with the actual state of affairs: if a revision by ^p yields a contradictory belief state, then ip cannot 
be true. 


Remark 3.10 (Classical reasoning (CR), modal reasoning (MR)). When discussing derivation in CDL, we 
will often suppress elementary reasoning steps familiar from the study of normal modal logics. Toward this 
end, “classical reasoning,” which may be denoted by (CR), refers to a derivation with one or more steps 
that makes use solely of (CL) and (MP). “Modal reasoning,” which may be denoted by (MR), refers to a 
derivation with one or more steps that makes use solely of (CL), (K), (MP), and (MN). 


Theorem 3.11 (CDL-theorems). The following schemes of (Cut), Cautious Monotonicity (CM), (Taut), 
(And), (Or), Positive Reduction (PR), and Negative Reduction (NR) are all derivable in CDL: 


(Cut) 

B^p>^ 

{B^^^X 

^B^X) 

(CM) 

B^if^ 

{B^X^ 

^bA^X) 

(Taut) 

Bip GG B'^ip 


(And) 

B^ipi ^ 

> {B^^2 

B'^{ipi A ip2)) 

(Or) 


■ (R’^V - 

-G Rpi'^^V) 

(PR) 

B^B^X 

GG (R^T V B^x) 

(NR) 

b^^b^ 

y GG (R^T V-R’^X) 


Also, the following rules of (Left) Logical Equivalence (LE), Right Weakening (RW), and Supraclassicality 
(SC) are all derivable in CDL: 


B^X ^ B^'x 

Proof. See the appendix. 


■(LE) 


X X 

B^X ^ B^x' 


(RW) 


B^ 


(SC) 


X 


□ 


The following result shows that CDL and CDLq derive the same theorems and therefore that these theories 
are identical. 

Theorem 3.12 (CDL-CDLq equivalence). For each cp G .ifcDi: 

CDL iff P CDLo P ■ 

Proof. See the appendix. □ 


That CDL is sound and complete with respect to the class of well-ordered plausibility follows by The¬ 
orem 3.12 and the results in Board’s work [5]. However, we provide a full proof of this in the appendix 


because the details will be useful when we consider a justified version of CDL. 
Theorem 3.13 (CDL soundness and completeness; [^). For each ip G .ifcDL^ 

hcDL iff \= P ■ 

Proof. See the appendix. 


□ 






4 AGM Belief Revision 


The most influential theory of belief change is due to Alchourron, Gardenfors, and Makinson [T]. Their 
theory, commonly called to the “AGM theory,” takes the view that an agent’s belief state (or “database”) 
is represented by a deductively closed set of sentences T called a “belief set.” The agent is understood to 
believe exactly those sentences in her belief set T, and various operators on T are used to describe various 
kinds of changes in her belief state. Of particular interest is the revision operator, now often denoted using 
the symbol “ * ”. This operator takes new information in the form of a sentence and produces another 
belief set T * if) that contains ijj. Intuitively, the revision operation assumes that the incoming information 
■0 is completely trustworthy and so it should be incorporated into the database. However, simply adding V’ 
and taking the deductive closure, forming the expansion 

r + v> := Cn(ru{v^}) (1) 

using an assumed consequence-closure operator Cn(— ) underlying the setting, might lead to an inconsistent 
belief set. By this it is meant that T + ip might be logically inconsistent according to the logic governing 
Cn(— ). Therefore, we cannot simply equate revision with expansion but must do something more clever so 
that the revised belief set T * ip not only contains ip but is also consistent whenever ip is consistent. 

Instead of providing an exact procedure for computing revision, the AGM approach is “postulate based”: 
a number of axiomatic postulates are provided, some intuitive justification is given as to why a revision 
operator should satisfy each of the postulates, and any operation on belief sets that satisfies all of the 
postulates is said to be an AGM revision operator. So in principle, there are many revision operators, and 
each is to be studied from an axiomatic point of view using the AGM revision postulates. 

Following the exposition of AGM theory from [7] (but with some minor modifications), we begin with a 
set ^ of propositional letters (usually countable). The set .ifcPL of formulas (the “propositional formulas” 
or “formulas of Classical Propositional Logic”) consists of those expressions that can be built up from 
the propositional letters and the Boolean constants T (falsehood) and T (truth) using the usual Boolean 
connectives. A deductive theory is assumed, and this theory is specified in terms of a Tarskian consequence 
operator: for any set S of formulas, Cn(5) is the set of logical consequences of S. It is assumed that Cn(— ) 
satisfies the following conditions: 

• Inclusion: S C Cn(iS'), 

• Monotony (also sometimes called “Monotonicity”): S Ci S' implies Cn(iS') C Cn(5'), 

• Iteration: Cn(S') = Cn(Cn(5)), and 

• Supraclassicality: Cn(5) contains each classical tautology in .ifcPL- 
It is usually assumed that Cn(— ) also satisfies the following conditions: 

• Deductive Consistency: T ^ Cn(0); and 

• Compactness: tp G Cn(5) iff there exists a finite S' C S such that (p G Cn(5'). 

The alternative notation S ip is used to express ip G Cn(S'). A belief base is a set of formulas in the 
language, and a belief set is a deductively closed belief base (i.e., Cn(S') = S). Note that the phrase “belief 
state” (a.k.a., “database”) is an intuitive notion meant to describe the agent’s situation with regard to her 
beliefs. This intuitive notion is formalized either by a belief base (not necessarily deductively closed) or 
a belief set (necessarily deductively closed). A belief base T' gives rise to a belief set T by applying the 
consequence operator: T := Cn(T'). 

A revision operator is meant to take an existing belief set T and some incoming information ip and 
produce a new belief set T * ip that incorporates the incoming information ip (i.e., ip ^ T * ip), is consistent 
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Postulates of AGM Belief Revision 

1. Closure: 

T *'if = Cn(T =t= 10) 

2. Success: 

if £ T * if 

3. Inclusion: 

T * if G T if 

4. Vacuity: 

if ^if ^ T, then T * if = T + if 

5. Consistency: 

if ^if ^ Cn(0), then T ^ Cn(T * if) 

6. Extensionality: 

if {if -G)- if') G Cn(0), then T * if = T * if' 

7. Superexpansion: 

T * {if A ip) C {T * if) -\- ip 

8. Subexpansion: 

if ^ Cn(r * if), then {T * if) + p <Z T * {if A p) 

Notes: S'-P'0 := Cn(S'U {i/'}); 

Cn(—) satisfies Inclusion, Monotony, Iteration, and Supraclassicality; 

Vacuity may be called “Preservation.” 


Table 3. The AGM revision postulates (as presented in 0) 


whenever the incoming information ?/) is consistent (i.e., T -i/; F _L if 'i/; is consistent), and is obtained from 
T by way of a “minimal change.” The latter is an intuitive (and non-formalized) guiding principle that is 
used to persuade the reader that certain proposed postulates are desirable. From a formal perspective, it 
can be safely ignored. 

The AGM revision postulates are reproduced in Table Postulates 1-6 are called the Gdrdenfors 
postulates (or, more elaborately, the “basic Gardenfors postulates for revision”). Postulates 7-8 are called 
the supplementary postulates. 

Grove proposed a possible worlds modeling of the AGM postulates. Modulo certain details we gloss 
over, his proposal essentially amounts to this: represent the agent’s belief set using the minimal worlds of a 
well-ordered plausibility model and define revision in terms of belief conditionalization. 

Theorem 4.1 (AGM revision and Grove spheres; adapted from [6]). Let Cn(— ) be the consequence function 
CPL(— ) of Classical Propositional Logic over the language .i^cPL- For each well-ordered plausibility model 
M, each belief set T C .ifcPLj and each propositional formula V' G .i^cPL, define 

M'*' := {y? G .ifcPL I min(lT) C , 

T V’ := G -^CPL I min[[V’lM C [[(/jIm} , 

®CPL := {L C ifcPL I CPL(L) = L} . 

Note that IBcpl is the collection of all propositional belief sets. For a propositional formula or set of 
propositional formulas X G .i^cPL U p(.^cpl), to say X is consistent means T ^ CPL(A) (or equivalently, 
that CPL(A) ^ -.Suzpl)) and to say X is inconsistent means it is not consistent. To say that a plausibility 
model M is a system of spheres means that M is well-ordered and the function 

*M (-) : .^CPL —> *Bcpl 

mapping propositional formulas G S^cp\_ to belief sets *m if G IBcpl satisfies the AGM revision 
postulates. To say that M is a Grove system for a belief set T G IBcpi means that M is a system of spheres 
and M'*' = T. 

(a) Each consistent belief set T G IBcpl has a Grove system. 
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(b) Suppose for a function * ; 5 Scpl x -^cpl ®cpl and each (T, V') G 5 Scpl x -i^cPL we have: 

(i) if T is inconsistent, then T * ip = M* V' some fixed system of spheres M*; and 

(ii) if T is consistent, then T * ip = T *Mt V’ for some fixed Grove system Mt for T. 

It follows that * is an AGM revision operator. 

Proof. See the appendix. □ 

This suggests that we may view CDL as a version of AGM belief revision in which the revision process 
itself can be described in the language laii!. In particular, for propositional formulas y? and ip^ the formula 
B(p, which is our abbreviation for ip, says that the agent believes p before the revision takes place; and 
the formula B'^p says that the agent believes p after revision hy ip. So by restricting to propositional p and 
Ip, we can use conditional belief formulas B'^p to describe a version of the AGM revision process directly in 
the language of .ifcDL- This leads us to the following overview of what the axiomatic theory CDL (Table 
has to say about the CDL-based version of AGM revision. 

• (CL) and (MP) indicate that we use a classical meta-theory. 

• The principles we have grouped together under the name “modal reasoning”—(CL), (MP), (K), and 
(MN)—together correspond to AGM Closure and AGM Extensionality. In addition, it follows by 
modal reasoning that our underlying “consequence operator” satisfies Inclusion, Monotony, Iteration, 
and Supraclassicality. 

• (Succ) corresponds to AGM Success. 

• Under the assumption of (Succ), scheme (KM) corresponds to consequence of AGM Consistency: 
inconsistency of revision by ip implies inconsistency of ip and therefore ol ip /\p, and so inconsistency 
of revision hy ip /\p follows via (Succ). 

• Under the assumption of (Succ), scheme (RM) corresponds to AGM Subexpansion. And li p = P, 
then (Succ) and (RM) together correspond to AGM Vacuity. 

• (Inc) corresponds to AGM Subexpansion. And, if y? = T, then (Inc) corresponds to AGM Inclusion. 

• (Comm) corresponds to a special case of AGM Extensionality (i.e., commutativity of conjunction). 

• (PI) and (NI) do not corresponds to principles in the AGM setting (belief sets are subset of .J^cpl). 

• (WCon) corresponds to AGM Consistency. 

5 Justified Conditional Doxastic Logic 

Though CDL may be viewed as a version of AGM revision in which Boolean combinations of revisions are 
expressible in the language, one key aspect that is missing: the reasons as to why revisions result in a state 
in which certain formulas are believed. This is a dehcit present also in AGM revision: while a revision by ip 
may lead to a belief set that includes p, it is not immediately clear why it is that p ought to obtain. What is 
missing is some language-describable reason that explains how it is p came about as a result of the revision. 
It shall be our task in this section to study how we might “fill in” these reasons in a theory based on CDL. 
Our approach follows the general paradigm of Justification Logic [2], where modal operators are replaced by 
syntactically structured objects called terms. Terms are meant to suggest “reasons” in the sense that the 
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syntactic structure of a term accords with certain derivational principles in the underlying logic. Our goal 
is to adapt this methodology to CDL. In particular, for a term t, we introduce new formulas 

t 

with the intended meaning that, whenever the agent revises her belief state by incorporating the formula tp, 
then t will be a reason justifying her belief of Lp in the resulting belief state. Intuitively, the formula t 
tells us two things. First, it tells us that the agent believes ip conditional on tp, which was the information 
conveyed in CDL by the formula B'^ip. Second, something new; the formula t'.'^ip tells us that the reason 
encoded by t supports tp. Taken together, t :'^ip tells us that the agent has a reason-based belief of ip after 
revising by ip. 

Terms will be built up using a simple grammar. At the base of this grammar are the “certificates,” 
which are terms of the form c^p for some formula tp. Intuitively, whenever we have one or more reasons in 
support of ip, the certificate picks out the “best” one. So whenever ip has any support at all, we are 
always guaranteed that names a particular reason in support of ip. As such, the theory we eventually 
define will derive the principle 

t-.'^ip Cp -^ip , 

which says that the certificate supports ip after a revision by ip whenever there is some reason t that 
support ip after the same revision. In essence, certificates allow us to “forget” the details of a complex 
argument in support of some assertion, remembering only that we at some point found such an argument. 

Though a certificate c<^ must support the formula ip it certifies, as per the above-mentioned derivable 
principle, we do not prevent from supporting other formulas as well. For example, it is consistent with 
the theory we will develop for us to have \'^x for some X 7^ As such, though we require certificates to 
provide “best evidence” for the formulas they certify, we do not require that this be the only evidence that 
they provide. 

Other terms are formed from certificates using one of two operators. The first is the Application operator 
“ • ” from Justification Logic. This operator is used to indicate that terms are to be combined using a single 
step of the rule of Modus Ponens. In particular, the logic we will develop will derive the following principle: 

t:^{ip,^ip2)^{s:^ipi^{t-s):^ip2) • 

This says that if t supports an implication after the revision by ^p and s supports the antecedent after the 
same revision, then the combination t ■ s supports the consequence after that revision. This is the reason- 
explicit version of the principle (K) of CDL. The difference is that the present version tells us something 
about how we obtained the consequent: the form of t ■ s, with t to the left and s to the right, indicates that 
t supports an implication and s supports the antecedent, and hence we were able to derive the consequent 
via one step of Modus Ponens in virtue of the fact that we use a single instance of the Application operator 
“ • ” to combine t with s to form t ■ s. 

The second term-combining operator we introduce is the Sum operator “-L” from Justification Logic. 
This operator allows us to combine to reasons in a way that preserves support. In particular, the logic we 
develop will derive the following principle: 

{t -.^ip V s :'^ip) {t + s) :'^ip . 

This says that t + s supports ip whenever at least one of t or s does so. As such, the sum t + s combines the 
supported statements of t and of s without performing logical inference. 

Formulas of the language will be built up from the language of Classical Propositional Logic (based on 
propositional letters, the constant J_ for falsehood, and material implication) by adding formulas of the form 
t :'^ip, where t is a term and ip and %p are other formulas. Intuitively, t \'^ip says that t supports the agent’s 
belief of ip after she revises her beliefs by incorporating ^p. 
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The theory we shall define is called Justified Conditional Doxastic Logic or JCDL. In addition to the 
derivable principles mentioned above, JCDL has a number of additional principles that make explicit the 
revision-based principles of CDL. In particular, we will see that every CDL-principle gives rise to a corre¬ 
sponding JCDL-principle, and the other way around as well. We explain this in more detail after the main 
definitions are in place. 

5.1 Language and axiomatics 

Definition 5.1 Let be a fixed set of propositional letters. The language of Justified Conditional 

Doxastic Logic consists of the set -SfjcDL of formulas ip and set =^cdl of terms t formed by the following 
grammar; 

ip ::= p\L \ {ip ^ ip) \ t :'^ip p G 
t ::= \ {t -t) \ {t + t) 

Standard abbreviations for Boolean constants and connectives are used, and parentheses are dropped when 
doing so will cause no confusion. We adopt the following key abbreviation: 

B'^ip denotes c<^ . 

We may write c{ip) as an abbreviation for c^p when convenient. Also, we let tap abbreviate t :®(^, and we let 
Bip abbreviate B^ip. 

Roughly speaking, it will be useful to think of B'^ip as the JCDL-analog of the CDL-expression B'^ip. We 
will see that every CDL-principle gives rise to a JCDL-principle obtained by replacing modal operators “ B'^ ” 
by reason-based operators Accordingly, if B'^ip is CDL-derivable, then a corresponding t:'^ ip' will 

be derivable, where ?/)' corresponds to V’ and ip' corresponds to ip). So using the certificate c<^/ for ip', it will 
follow that B'^ if' is derivable as well. It is in this sense that B'^ ip' may be thought of as the JCDL-analog 
of the CDL-principle B'^ip. 

Definition 5.2 (JCDL theory). The theory JCDL is defined in Table 

(CL) and (MP) tell us that JCDL is an extension of Classical Propositional Logic. 

(eK) is our reason-explicit analog of the CDL-scheme (K); it tells us that reason support is closed under 
the rule of Modus Ponens using the Application operator “ • (eSucc) is our reason-explicit analog of CDL 
(Succ); it tells us that certificates are used to certify the success of belief revisions. (eKM) is our reason- 
explicit version of (KM); it tells us that a reason supporting a contradiction conditional on some ^|J continues 
to do so no matter what additional information we conjunctively add to the conditional. 

(eRM) is our reason-explicit version of (RM). The antecedent is just Inotc^p :'^—>ip. Since the 

certificate c-,,^ will always stand in for some argument relevant to —<ip, the antecedent —<B'l'—<ip tells us that 
ip is consistent with the belief state obtained after revision by And (eRM) tells us that if this is so and 
t is a reason to believe x after revision by ip, then it follows that t is still a reason to believe y even after 
we revise by the conjunction ip A ip. Notice that the reason t for x does not change; it is only the revision 
formula itself that changes. 

(einc) is our reason-explicit version of (Inc); it tells us that that a belief of ip ^ ip is certified after 
revising by ip so long as there is a reason t for believing ip after revising by ip A ip. (eComm) tells us that 
reasons are invariant to the order of conjuncts in revisions; this is the reason-explicit analog of (Comm). 
(ePI) and (eNI) are the reason-explicit versions of (PI) and (NI), respectively; these tell us that all support 
and negated support statements are certified. (eWCon) is the reason-explicit analog of (WCon); it tells us 
that if t is a reason supporting a belief in T after revision by ip, then ^ip must have been true. 

(eA) is particular to JCDL. This scheme tells us that if t supports a belief in ip conditional on ip and 
ip is also certified conditional on some other X; then t must itself support ip conditional on x as well. This 
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Axiom Schemes 

(CL) 

Schemes for Classical Propositional Logic 

(eCert) 


(eK) 

t P 2 ) (s {t ■ S)&p2) 

(eSum) 

s:^p) ^{t + s) :^p 

(eSucc) 

B^ij 

(eKM) 


(eRM) 

^B^^p {t :^x t 

(einc) 


(eComm) 

t &^^x t 

(ePI) 

t-.^X^B^{t.^x) 

(eNI) 

-^t-.^X^ B^ht-.^X) 

(eWCon) 


(eA) 

t :'^p —)• {B^p —)■ t :^p) 


Rules 

^ (MP) -^(eMN) 


Note: B^p abbreviates ■.'^p. 

Table 4. The theory JCDL 




tells us that if a reason supports a belief of after some revision, it does so no matter the particulars of 
the revision. Said another way, reason support depends only on the statement supported (and not on the 
revision). 

(eMN) says that every derivable formula is “certified” (i.e., supported by its certificate). This corresponds 
to the CDL-principle (MN). But while all derivable principles are certified, intuitively such certification omits 
a great deal of information; in particular, it is not clear from which axioms a given principle follows and 
how it is that it follows by way of the rules of the theory. Toward this end, it will be useful to consider a 
restriction of (eMN) in which we apply this rule only to axioms, possibly multiple times in a row. An axiom 
to which we apply (eMN) zero or more times in a row will be called a “possibly necessitated axiom.” We 
will see that if we remove (eMN) from the theory, then all JCDL-theorems can be derived from the possibly 
necessitated axioms using (MP) as the only rule. The trick to this will be to eliminate from JCDL-derivations 
uses of (eMN) that are “troublesome necessitations”: these are the derivable consequences of (eMN) that 
are not themselves possibly necessitated axioms. If we can show that all such “troublesome necessitations” 
can be eliminated, then the result follows. This will be our task now. 

The terms that can be formed from certificates of possibly necessitated axioms using the Application 
operator “ • ” will be called the “logical terms.” These terms play a special role: every JCDL-theorem ip gives 
rise to a logical term t that supports p (i.e., t :'^p is derivable for each ?/)). 

Definition 5.3 (Necessitations, logical terms). A necessitation is a .ifjcDL-formula of the form 

gbn gbn-l^bn-2 . . . (2) 

zero or more of these 

for some integer n > 0. A possibly necessitated axiom is a .ifjcDL-formula of the form ([^ for which n > 0 
and is a JCDL-axiom. The set logical terms is the smallest set that contains certificates c^ for 

each possibly necessitated axiom p and is closed under the term-forming operation t, s ^ t ■ s. 

Definition 5.4 (Troublesome necessitations, notation vr p)- A SQDL-derivation is finite nonempty 

sequence of .ifjcDL-formulas, each of which is either a JCDL-axiom or follows by a JCDL-rule from formulas 
occurring earlier in the sequence. A line of a JCDL-derivation vr is an element of the sequence vr. A 
troublesome necessitation is a line p oi a. JCDL-derivation that neither is a possibly necessitated axiom nor 
follows from earlier lines by (MP). Clearly, a troublesome necessitation must follow by applying (eMN) to 
an earlier line that is not itself a possibly necessitated axiom. For n G N, we write tt Pjcdl ‘-P mean that tt 
is a JCDL-derivation that contains at most n troublesome necessitations and whose last line is p. For n G N, 
we write Pj^dl ^ mean that there exists a JCDL-derivation tt such that vr Pjcdl P’- Obviously, Pjcdl P’ 
implies Pjcdl ^ some n G N. 

The following lemma shows that every JCDL-theorem can be derived from the possibly necessitated 
axioms using (MP) as the only rule of inference. 

Lemma 5.5 (Elimination of troublesome necessitations). For each p G .ifjcDL) we have: 

Pjcdl ‘P ^ D tt, tt* Pjcdl • (3) 

Proof. See the appendix. □ 

“Theorem Internalization” is a property of Justification Logics whereby every theorem p of the logic 
is witnessed by supporting term. Since certificates trivially support JCDL-theorems by (eMN), the usual 
formulation of Theorem Internalization is trivialized in our setting. However, we can prove a stronger 
variant: every JCDL-theorem p is witnessed by a logical supporting term. This stronger version tells us that 
all JCDL-theorems are witnessed by terms that refer only to possibly necessitated axioms and combinations 
of these using rule (MP). 
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Theorem 5.6 (JCDL Theorem Internalization). For each ^ G .^jcdLj we have: 

l“JCDL G ^CDL> ^JCDL t■ 

Proof. See the appendix. □ 

5.2 Relationship to CDL 

In our motivation of JCDL, we have described the formula as an analog of a corresponding ..S^cdl- 

formula Up to this point, the idea was mere intuition. We now make this intuition precise by defining 

two mappings. The first, called “forgetful projection,” maps .ifjcDL-formulas to .ifcDL-formulas by replacing 
each “ t ” prefix by the prefix “ ”. The second, called “trivial realization,” maps .J^fcoL-formulas to 

.ifjCDL-formulas by replacing each prefix “ B'^ ” by the prefix “ B'^ ” . We will see that these operations 
preserve derivability of schemes. 

Definition 5.7 (The forgetful projection). The forgetful projection is the function 

(-)° : -5fjCDL —^ .^CDL 


defined by: 


q° ■= q for g G U {J_} 

{(f —>■ 'tp)° := (p° —>■ 'tp° 

{t:^ip)° := 

The forgetful projection oi ip G -S^jcDL is the V’” C -^CDL- Extend the function (—)° to sets F C .ifjcDL by 
F° := {(/?° I G F}. We further extend the function (—)° to schemes. In particular, let 5 be a fixed set of 
schematic variables (i.e., “metavariables” or placeholders for formulas) that includes all schematic variables 
used in this paper and that has cardinality min{|,i^|, w}. For each of our languages .if G {.ifcDLj-S^ jcdl}) 
let -Sf(5) be the set of formula schemes that can be formed using the formula formation grammar of .if 
but with schematic variables in S used in place of propositional letters in Define t^]CDL{S) similarly. 
Using and 'k as metavariables ranging over members of .ifjcDL(‘5) and T as a metavariable ranging over 
members of ^cdl(‘ 5), let 


:= X for X G 5 U {_L} 
\j/)° := (|)° \j/° 

(r:'^^>)° := 


Extend the function (—)° to sets F C .ifjcDL(‘5) by F° := {<1>° | G F}. 

Definition 5.8 (Realizations and the trivial realization). A realization of a formula ip G .ifcoL is a formula 
G .ifjcDL for which 'ip° = ip and Fjcdl V'- The trivial realization is the function (—)* : JfcoL —>• -2jcdl 
defined by: 


q* '■= q for q G ^ U {J_} 
(ip —)> ipY •= V’* 

{B^ifY := 


We extend the function (—)* to sets F C .ifcoL by F^ := {ip^ \ ip G F}. 
notation from that definition, we extend the function (—)* to schemes: 


As in Definition 5.7 and using the 


X* :=X for A G 5 U {_L} 
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($ 'I')* := 


Finally, we apply (—)* to sets F C ^cdl{S) by defining F* := | $ G F}. For some object Z in the domain 

of (—)* we say that Z* is the trivial realization of Z. 

The trivial realization of a formula or scheme of CDL is obtained by replacing each “S ” with “S ”. Note 
that while the word “realization” in the phrase “trivial realization” suggests that the trivial realization of 
a formula or scheme is indeed a realization (i.e., we obtain something derivable in JCDL), this does not 
come automatically (i.e., by definition) because the trivial realization is a mere syntactic translation and so 
it must be proved that this translation satisfies the requisite property before the conclusion can be drawn. 
However, the following theorem guarantees that the trivial realization is indeed a realization. The theorem 
also tells us that the forgetful projection maps JCDL-theorems to CDL-theorems. 


Theorem 5.9 (Projection and realization for schemes). We use the notation from Dehnitions 5.7 and 5.1 
For each F U {ip} C .ifjcDL(‘5) and each A U {'tjj} C ^co\_iS), we have: 


1. r PjcDL 'P implies F° Pcdl P°, and 

2. A hcDL "0 implies A* Pjcdl V'*- 


Proof. See the appendix. 


□ 


Theorem 5.9 tells us that JCDL really is an explicit analog of CDL: every JCDL-derivable statement 
gives rise to a CDL-derivable statement (by forgetful projection), and every CDL-derivable statement gives 
rise to a JCDL-derivable statement (by trivial realization). This link makes precise our intuition that the 
.ifcDL-formula B'^ip should correspond to the AfjcDL-formula B'^ip. 

Though Theorem|5.9|is stated with respect to schemes, we have the analogous result for formulas as well. 


Theorem 5.10 (Projection and realization for formulas). We use the notation from Definitions 5.7 and 5.8 
For each F U {p} C .ifjcoL and each A U {f)} C .ifcDL, we have: 


1. r PjcDL P implies F° Pcdl P° , and 

2. A PcDL "0 implies A* Pjcdl V'*- 


Proof. Replace each distinct propositional letter with a distinct schematic variable, apply Theorem 5.9, and 


take the instances of the resulting derivable schemes obtained by substituting the original propositional 
variables back into their corresponding positions. □ 


Using Theorem |5.9| the CDL-principles from Theorem |3.11| translate into JCDL-principles. 

Theorem 5.11 (JCDL-theorems). The following schemes of (eCut), Explicit Cautious Monotonicity (eCM), 
(eTaut), (eAnd), (eOr), Explicit Positive Reduction (ePR), and Explicit Negative Reduction (eNR) are all 
derivable in JCDL: 


(eCut) B^p B^X) 

(eCM) B^^ {B't’x 
(eTaut) Bip B^(p 

(eAnd) B^pi {B^p2 ^ B^{pi A ^^2)) 

(eOr) B^^ip {B^^ip B^^'^^^ip) 

(ePR) B^B^x ^ {B'^^ V B^x) 
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(eNR) ^ V 


Also, the following rules of Explicit (Left) Logical Equivalence (eLE), Explicit Right Weakening (eRW), and 
Explicit Supraclassicality (eSC) are all derivable in JCDL: 


fj' 


Bi’X o B^'x 


(eLE) 


Proof. Apply Theorems 3.11 and 5.9 2). 


x^x' 

B^X B^X' 


(eRW) 


'iA X 
B^X 


(eSC) 


□ 


5.3 Semantics 

One of the main possible worlds semantics for Justihcation Logic is the semantics due to Fitting (see [2] for 
details). Here we adapt the traditional Fitting semantics for use in our language .ifjcDL- 

Definition 5.12 (Fitting models). A Fitting model is a structure M = {W, <,V,A) for which [W, <,F) is 
a locally well-ordered plausibility model and A is an admissibility function: a function 


^ : (=^CDL X -S^jcdl) —>• p(bF) 


that maps each term-formula pair {t, (p) to a set A(t, ip) <ZW of worlds subject to the following restrictions: 


• Certification: A{c^p,p) = W, 

which says formulas are certihed by their certihcates; 


• Application: A{t, p\ —)• (^ 2 ) C A(s, pi) C A{t ■ s, P 2 ), 

which says the Application operator encodes instances of (MR); 

• Sum: A(t, p) U A(s, p) C A{t + s, p), 

which says the Sum operator encodes support aggregation without logical inference; and 

• Admissibility Indefeasibility: if x G A{t, p) and y G cc(x), then y G A(t, p), 

which says admissibility is constant within each connected component. Using the notion of “knowledge” 
from Remark |3.3[ this tells us that the agent knows her admissibility function. 


The notion of pointed Fitting model is similar to the corresponding definition found in Definition 2.2 
also apply the terminology from that definition to Fitting models in the obvious way. 


we 


If A is an admissibility function, then w G A(t, p) says that, from the perspective of world w, term t has 
the proper “syntactic shape” to be a reason in support of p. This does not, however, guarantee that t does 
indeed support p. For this we shall require something more. 


Definition 5.13 (.ifjcoL-truth). Let M = (W, <, V, A) be a Fitting model. We extend the binary satisfaction 
relation |= from Definition 3.2 to one between pointed Fitting models (M, w) (written without surrounding 


parentheses) and .ifjcDL-formulas and we extend the function [[—]] from Dehnition |3.2| to include a function 
l-j : ifjcDL p{W) as follows. 


• IpJm := {u G if I M,v 1= p}. The subscript M may be suppressed. 

• M,w ^ ±. 

• M, w \= p iff p € V{w) for p G 

• M, w \= p ^ iff M, w ^ p or M, w |= 
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(4) 


• M,w\=t iff G A{t, ip) and 

Vx G cc{w) : x4 PI [[V^J =0 or 3y G n [V’l : P [[?/;]] C [[(^J . 

So to have true at a world w, we must have two things. First, from the perspective of w, term t 
must have the correct “syntactic shape” for an argument in support of y?; that is, we must have w G A{t, (p). 
Second, we must satisfy the condition Q, which is the same condition we had for truth of a .ifcDL-formula 
B'f’ip. So, taken together, to have t :'^ip true at world w means that t has the “shape” of an argument for (p 
and the agent believes (p after revising her beliefs by V'- The following theorem states this precisely. 

Theorem 5.14 (JCDL-truth in terms of belief formulas). Let M = {W, <, V,A) be a Fitting model. 

M, w \= t iff rc G A{t, p) and M, w ^ B'^p . 


Proof. Left to right (“only if”): assume M, w \= t '.'^p. By Definition 5.13, we have w G Aft, p) and Since 
we have w G A{c^p, p) by the Certification property of admissibil ity fu nctions and we have B'^p = c^p ■.'^p by 
definition, it follows from by Q and w G A(Cfp,p) by Definition 5.13 that M,w |= Bjfjp. 


Right to left (“if”): assume w G A[t,p) and M,w ^ B'^p. Applying Definition 


5.13 


B^p = Cp ■.'^p, it follows that (|^. So since we have w G A{t,p) and (|^, it follows by Definition 
M,w \=t :‘^p. 


and the definition 
that 


5.13 


□ 


In well-founded Fitting models, belief in p conditional on if is equivalent to having p true at the most 
plausible ?/)-worlds that are within the connected component of the actual world. 

Theorem 5.15 (JCDL-truth in well-founded models). Let M = {W, <, V, A) be a Fitting model. 

(a) If M is well-founded: M,w \=t ■.'^p re G A{t, p) and min|{'0]] P cc{w) C [y?]]. 

(b) If M is well-ordered: M,w |= t-.'^p rc G A{t,p) and minj'i/;]] C 


Proof. (Q, left to right (“only if”): assume M,w \= t:'^p. By Definition 5.13 we have w G A{t,p) and (|^. 
Use the argument in the proof of Theorem |3.4| to conclude that min|{'0]] P cc{w) C right to left 

(“if”): assume w G A{t,p) and min[f'0 || P cc {w) C Use the argument in the proof of Theorem 3.4 to 
conclude that 0. Applying Definition |5.13| it follows that M,w |= t:'^p. 

Q: M is well-ordered, then cc{w) = W and M is well-founded. Apply (Q. □ 


And so in well-founded Fitting models, we can see that formulas B'^p really do play the semantic analog 
of .ifcDL-belief formulas. 

Theorem 5.16 (JCDL-truth in well-founded models in terms of belief formulas). Let M be a Fitting model. 

(a) If M is well-founded: M,w \= B'^p minjV']] P cc{w) C 

(b) If M is well-ordered: M,w |= B^p min|{V^]] C [[:^]]. 

Proof. By the Certification (Definition 5.12) and Theorems 5.14 and 5.15 □ 


Similar to .^cdl, the intended semantic objects for .ifjcDL are the well-ordered models of the appropriate 
type (in this case Fitting models, as opposed to simple plausibility models). 

Definition 5.17 (.J^fjcoL-validity). To say that a .ifjcDL-formula p is valid, written |= p, means that M \= p 
for each well-ordered Fitting model M. Though we use the same symbol for ..^fjcoL-validity as we did 
for .ifcDL-validity, it will be clear from context which notion is meant. 


And as for CDL, locally well-ordered plausibility models would suffice. 
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Theorem 5.18 (.ifjcDL-validity with respect to local well-orders). Let be the class of locally well-ordered 
Fitting models. For each ip G .i^jcDLj we have: 


1 = ^ 


iff 


VM edL, M\= ip . 


Proof. As in the proof of Theorem 3.6 


□ 


Soundness and completeness of JCDL with respect to its intended semantics (i.e., well-ordered Fitting 
models) makes use of many components of the proof of Theorem 3.13, itself essentially due to [5]. 

Theorem 5.19 (JCDL soundness and completeness). For each ip G 

hjcDL iff h ■ 


Proof. See the appendix. 


□ 


6 Conclusion 


We saw earlier that CDL is a version of AGM revision in which Boolean combinations of revisions are 


expressible in the language. Since JCDL is a reason-explicit analog of CDL (as per Theorem 5.9), we are led 
to the following suggestion: JCDL is a version of AGM revision in which Boolean combinations of reason- 
explicit revisions are expressible in the language. In essence, a formula ip that is part of the belief state 
after revision by V’ niay be witnessed by a specific reason t whose syntactic structure tracks the genesis of 
ip stepwise from basic principles. This suggests we think of JCDL as a theory of revisable justified belief. It 
would be interesting to see if there is some explicit version of the AGM revision principles that matches up 
with JCDL in the way that standard AGM matches up with CDL. However, we leave this issue for future 
work. 


A Technical results 

A.l Results for plausibility models 

Proof of Theorem |g.4 Itemis obvious. Item is a well-known result from order theory, but we reprove it 
anyway for completeness purposes. So assume M is locally well-ordered and 0 / S' = cc{w) C W for some 
u; G IF. Define 

S' := {x G S I Vy G S : X < ?/} . 

We wish to prove that minS = S'. Proceeding, take x G minS. If y G S as well, then it follows from 
X G minS by the definition of minS that y -jt x, from which we obtain x < y because S is a connected 
component and < is total on each connected component. Since y G S was chosen arbitrarily, it follows that 
X G S'. Hence minS C S'. To show the inclusion holds in the other direction, take x G S'. If y G S, then it 
follows from x G S' by the definition of S' that x < y, from which we obtain y ft x hy the definition of -fi. 
Since y € S was chosen arbitrarily, it follows that x G minS. Hence S' C minS. 

For Item[^ it follows from the fact that < is well-ordered that IF is a connected component. Further, 
since < is well-ordered, it is also locally well-ordered. The result therefore follows by Item[^ 

For Item|^ let us first assume that M is well-founded. We wish to prove that each S G p(IF) is smooth 
in M. So take S G p(IF). Since 0 is smooth in M, let us assume further that S / 0. Now take x G S. 
Since x G x'*' n S by the reflexivity of <, it follows that x'*' H S' 7^ 0. Therefore, since M is well-founded, it 
follows that min(xf' H 5) 7^ 0. That is, there exists y G min(xf' H S). But then y < x and x -fi y, from which 
it follows that y ~ x or y < x. And if y ~ x, then it follows from y G min(xf' H S) by the transitivity of < 
that X G min(xf' H S'). So either we have x G min(xf' H S) or we have y G min(xf' H S') and y < x. Further, 
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for each m G min(x'*' H S) and z ^ S — {x^ H S), we have by the transitivity of < that z ^ m. And for 
each m G min(x'*' n S) and z G (x'*' n 5), we have by the definition of min(x'*' n S) that z ^ m. But then 
m G min(x'*' Pi S) implies m G min S. Taken together, we have shown that for each x G S', either x G min S 
or there exists y G minS such that y < x. It follows that S is smooth in M. Since we have shown that every 
S G piW) is smooth in M, it follows that M is smooth. 

For the converse of Item we assume that M is smooth. We wish to prove that M is well-founded. 
So take a nonempty S C W. Since S is nonempty, we have x G S. But M is smooth and so S is smooth 
in M, and so it follows that x G min 5 or there exists y G min S' such that y < x. In either case, we have 
minS 7 ^ 0. So M is well-founded. 

Items and follow from Item by Definition 2.2 □ 


A.2 Results for CDL 


Proof of Theorem 3-4 a). Assume M is well-founded and M,w ^ The latter means 


Vx G cc{w) : X'*' n [V']] =0 or G x'*' P [V^]] : y^ P C [[(^J . 


(5) 


If minj^/i]] P cc{w) = 0, then min|{V^]] P cc{w) C [y?]]. So let us assume further that min[[^/i]] P cc{w) ^ 0. Take 
z G minJV’]] P cc{w). Since we then have z G z'*' P [V’l by the reflexivity of < and the definition of minJV’]], it 
follows by Q that 

3y£z^r\ m : y^ P {ipj C [y?]] . 

Now z G cc{w) and y G z'*' P [V'l, so it follows that y G cc{w) and therefore that y G [V'l P cc{w). From 
this we obtain by z G min[['0]] P cc{w) that y ft z. But y G z'*', and therefore we have y < z and z < y. 
As a result, z G y"*" P [V’l C [y?]]. Since z G minjt/;]] P cc{w) was chosen arbitrarily, we have proved that 
minj';/’]] P cc{w) C [y?]]. 

Conversely, assume M is well-founded and minJV']] P cc{w) C [(^J. To show that we have M,w ^ B’t’tp, 
we must show that obtains. For this it suffices for us to take x G cc{w) satisfying x'*' P [V’l 7 ^ 0 and prove 
that 

3y G x-*- P [V’l : y^ P [V’l ^ [y?]] . ( 6 ) 

Proceeding, since x'*' P ['0]] 7 ^ 0 and M is well-founded, it follows that there exists y G min(x'*' P ['j/^]]). Since 
min|{'0]] P cc{w) C [y?]], if we can show that for every z £ [[?/;]] we have z G minJV’]] P cc{w), then it would 

follow that y'*' P [V'l C [yj]] and therefore that (|^, completing the argument. So take z G y"*" P [[V’l- It follows 
by z G y'*', y G x'*', and x G cc{w) that z G cc{w). So to show that z G minJV’]] P cc{w), all that remains is to 
prove that z G minj?/;]], and for this it suffices to prove that n G z'*'P [V'l implies u ft z. So take tt G z'*'P ['0]]. 
Since tt G z'*', z G y'*', and y G x'*', we have 


u < z < y < X . 

By the transitivity of <, it follows that u < y and u < x. Hence u G x'*' P [['(/’I- Since y G min(x'*' P [V’D, 
it follows that u ft y. But from u ft y and u < y, it follows by the definition of ft that y < u. And from 
z < y < u, it follows by the transitivity of < that z < u. Applying the definition of ff, we obtain u ft z. □ 

Proof of Theorem \3 .1 1\ We reason in CDL. For (Cut), assume B't^p and B't’^'^x- It follows from by 

(Inc) that —)• y). But from B^{(p —)• x) and B^cp we obtain by (MR) that 

For (CM), we reason by cases under the assumption B’t^p. First: if —<Bt^—<p, then we obtain B^x 
B'^^'^X by (RM) and (CR). Second: if B't-<(f, then it follows by our assumption B't’ip and (MR) that B'ttL\ 
applying (KM) and (CR) yields from which we obtain B't’^'^x by (MR). 

(Taut) obtains by (CR) since Bp = B~^p. (And) obtains by (MR). 

For (Or), we assume B't’^p and B't’^p. Take i G {1,2}. By (Succ) and (MR) we obtain V if 2 )- 

From V '02) and our assumption B't^^p, we obtain by (CM) and (Comm) that From 
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this it follows by (Inc) that —)> ip). Since we have this for each i G {1, 2}, it follows by (MR) that 

V 1 (^ 2 ) —>• p)- Since V ■02) by (Succ), we obtain the result by (MR). 

For (PR), we have the following: 


1. 

B^^B^X {B^B^x B‘^±) 

(MR) 

2. 

(R^R^y A ^R^T) ^ ^R^^R^y 

(CR), 1 

3. 

-.B^X ^ B'^^B^x 

(NI) 

4. 

^RV^^RV’y ^ B^X 

(CR), 3 

5. 

(R^R^y A ^R^T) ^ R^y 

(CR), 2, 4 

6. 

B^B^X (R^A V R^y) 

(CR), 5 

7. 

B^X ^ B'^B^x 

(PI) 

8. 

R^T ^ B^B'f’x 

(MR) 

9. 

(R^T V R^y) ^ B^B^x 

(CR), 7, 8 

10. 

B^B^X ^ (R^A V B^x) 

(CR), 6, 9 

To obtain the proof for 

(NR), replace each occurrence of R^x 

in the above proof with -■R’^x und change 


the reason for line 7 from (PI) to (NI). It is straightforward to verify that this operation yields a derivation 
of (NR). 

For (LE), assume ip ■(-)> . We have B'^^p by (Succ). Applying (MR) to our assumption, we obtain 

B'^{ip —)■ ?/)'). Hence B^p;' by (MR). By similar reasoning, we obtain B'^'ip. Now by (CM), B'^ipP (Comm), 
and (CR), we obtain B'^x B^'^^x- Py B'^'ip, (Cut), and (CR), we obtain B^'^^x X- Put then it 

follows by (CR) that B'^x B'^ x- A similar argument shows that B'^ x B'^x- Py (CR), we conclude 
that B^x ^ B^'x. 

(RW) follows by (MR). For (SC), from -ip ^ p we obtain B'^{'ip —>■ p) by (MN); however, we have B'^^p 
by (Succ), and so it follows by (MR) that B'^p. □ 


Proof of Theorem \3.1S\ Left to right: it suffices to show that CDL derives (lEa), (lEb), and (LE). 

• (lEa): hcDL B^p (R’/’A^y o R^y). 

By (CM), (Cut), and (CR). 

• (lEb): hcDL -^B^^p ^ B^{p y)). 

Reasoning in CDL, by (Inc) and (CR) we have 

^ [B'f^^X^ B^{p ^ X)) , 


and so it suffices by (CR) to prove that 


^B-^^p ^ {B'l’ip ^ y) ^ R’^^^y) . 


(7) 


Proceeding, we have 

^B^^p ^ {B^{p ^ y) ^ B^^^ip ^ y)) (8) 

by (RM). We also have B'^'^'^{'ip /\p) by (Succ) and therefore B'^^'^p by (MR). But then we obtain Q 
from ([^ and B'^^'^p by (MR). The result follows. 


(LE): if hcDL '0 , 


By Theorem 3.11 
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This completes the left-to-right direction. Right to left: it suffices to show that CDLq derives (KM), (RM), 
(Inc), and (Comm). 

• (KM): hcDLo B'f’l. 

We reason in CDLq. We have B'^ 1. — {B'^ip A B'^ 1) by (MR). Applying (lEa) and (CR), we obtain 
. (RM): hcDLo ^ {B^X ^ B^^^x)- 

Reasoning in CDLq, we assume and B'^x- K follows from B'^x by (MR) that B'^{ip — )■ x)- 

From this and our assumption -iRb-, (/?, we obtain B^^'^x by (lEb) and (CR). 

• (Inc): hcDLo B^^^x ^B^{ip^x)- 

We reason in CDLq by cases. First: if (/j, then we obtain B'^^^x B^{(p —)> x) by (lEb). Second: 

if B'^^p, then we obtain B'^{p —)• x) by (MR) and therefore B'^^’^x B'^{p — x) by (CR). 

• (Comm): hcou B^^^x ^ B^^^x- 

By (LE) and (CR). □ 


Proof of Theorem\3.1S\ We use the notation and concepts from Remark 3.8 Let 




CDU 




{a} 


CDL 


and CDLq := CDL, 


{a} 


We write for the .ifcDLa’foi’niula obtained from the .ifcDLo'Io^niula x by recursively replacing each occur¬ 
rence of a modal operator B^ in x by B^. Obviously, (x'^)^ = X nnd {O'Y = 9. 

It was shown by Board [5] that we have kcoLa X iff NcdV T- By Remark 
statement that 

Vx G -^CDU : bcDL, X iff 1= x' • (9) 

By induction on derivation length, it is easy to see that the operation x X“ maps CDLo-theorems to 
CDLa-theorems and the operation x X^ maps CDLa-theorems to CDLo-theorems. So LcdLo P iff bcDLo 
Applying Q and the fact that {pY' — P: obtain LcdLo P iff 1= P- Applying Theorem 

hcDL P iff 1= P- n 


3.12, we obtain 


3.8 


this is equivalent to the 


Proof of Theorem 3.13. The argument can be obtained by combining the ideas from the various proofs in 
[5]. However, this requires restricting to the single-agent case and combining multiple arguments, so it is 
not so transparent how the argument should go. In the interest of making the argument clear and so that 
we have some constructions available for us later when we turn to the JCDL case, we provide a full proof 
here. However, the argument is truly due to [S]. 

For soundness, we proceed by induction on the length of derivation. In the induction base, we must show 
that each axiom scheme is wf-valid. (CL) is straightforward, so we proceed with the remaining schemes. Let 


M be an arbitrary well-founded plausibility model. We make tacit use of Theorem 3.4 


• (K) is valid: |= B'^{pi —)■ p2) —)• {B'^pi —)• B'^p2). 

Assume {M,w) satisfies B^{pi —)> P2) and B'^pi. Then min|{V^]] C \pi —)• (^2! and minJV’]] C [[y?i]]. 
Hence min[[V’]] C So {M,w) satisfies B'^p2. 

• (Succ) is valid: ^ B’^if- 

We have minj'i/’]] C [[' 0 ]] by the definition of minj'i/^]]. So {M,w) satisfies B'^Y- 
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• (KM) is valid; |= B^± 

Suppose {M,w) satisfies B'^B. Then minJV’]] C [Tj = 0. Since M is well-founded, it follows that 
[V’l = 0- But then A (/?]] = 0, from which it follows that minJV^ A (/?]]= 0 C [Tj. So {M,w) satisfies 

• (RM) is valid; |= -^B^^ip {B'^x ^ B^^‘^x)- 

Suppose {M,w) satisfies ^B^^p and B'^x- B follows that minJV’]] ^ [[“'<^1 and minJV’]] C [[;;^;]]. Hence 
minj^/;]] n [[(/9]] / 0. We prove that min|{V’ A (/^J C min[['0]] n [[c/?]]. Proceeding, take x G minj^/; A 
Since min[[^/;]] n [[c/?]] / 0, there exists y G min [[?/;]] n [[(/j]]. Hence y G [[V’ A Since x G minj^/; A p\ and 
< is total, we have x < y. But x G [V’l and y G min[['0]], and therefore it follows from x < y that 
X G min[['0]] as well. Since x G [[(/?]], we have x G minj^/;]] n [[(/9]]. Conclusion; minj^/; A </?]] C min[['0]] n 
So since min[['0]] C [[;;^;]], it follows that 

minlV' A (/9]] C mml'i/jj n C {xj C [[v?]] C {xj . 

That is, minj-i/i A C [xj. So {M,w) satisfies B'^^'^x- 

• (Inc) is valid; |= B'^^'^x B'^{ip —)■ x)- 

Suppose {M,w) satisfies B^^'-^x- Then minJV'A (/?]] C [xj. We prove that minJV']] C [[(/7—)-xl- Pro¬ 
ceeding, take X G min[[^/;]]. If x ^ [[(/9]], then x G [[(/9 —)• xl- So let us assume further that x G [[(/?]] and 
therefore that x G [V' A (^J. Now take any y G [V' A (/?]]. Since y G [['01, if we had y < x, then it would 
follow that X ^ min[['01, contradicting our choice of x. Hence y G [[0 A (/^l implies y x, from which it 
follows by X G [[0 A (/^l that x G min[[0 A p\. But we have min[[0 A C [xl and hence x G [xl, from 
which we obtain x G [v? —)• xl- Conclusion; {M,w) satisfies B^{p —)■ x)- 

• (Comm) is valid; |= B'^^'-f’x —> B'^^'^x- 

Suppose {M,w) satisfies Then min[[0 A (^1 C [xl. Since [[0 A (/^l = [[(/?A01, it follows that 

min[[(/9 A 01 C [xl. But then {M,w) satisfies B'^^^x- 

• (PI) is valid; |= B^x ^ B'^B^x- 

Suppose {M,w) satisfies B'^x- Hence min[[01 C [xl, which implies that {M,v) satisfies B'^x for rmy 
given V G cc{w) = W. That is, [B’^xl = H^- Therefore, min[[(/9l C [[H’^xl- Conclusion; {M,w) satisfies 

B'^B^X- 

• (NI) is valid; |= ^B^x ^ B'^^B^x- 

Suppose {M,w) satisfies -■H'^X- Then min[[01 ^ [xl- It follows that M,v |= -'B'^x for each v G 
cc{w) = W. Therefore, [[“'B^xl = H^, from which it follows that min[[(/9l C [[-iH’^xl- Conclusion; 
{M,w) satisfies B^^B'^x- 

• (WCon) is valid; |= —>• -i0. 

Suppose {M,w) satisfies B'^B. It follows that min[[01 C [Tl = 0. Since < is well-founded, it follows 
that [[01 = 0. But this implies [[-'01 = W. So (M, w) satisfies -10. 

This completes the induction base. For the induction step, we must show that validity is preserved under 
the rules of (MP) and (MN). The argument for (MP) is standard, so let us focus on (MN). We assume [= p 
for the CDL-derivable p (this is the “induction hypothesis”), and we prove that [= B'^p. Proceeding, since 
we have [= p by the induction hypothesis, it follows that [[(^1 = W and hence that min[[01 C [[(^1. But then 
(M, w) satisfies B'^p. Soundness has been proved. 

Since CDL is sound with respect to the class of well-ordered plausibility models we note that CDL is 
consistent (i.e., Pcdl T)- In particular, take any pointed plausibility model {M,w) containing only the 
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single world w. Since there is only one world, M is well-ordered. Further, by soundness, we have that 
hcDL to M,w 1= if. Therefore, since M,w T by Definition 3.2, it follows that Fcdl T. That is, CDL is 
consistent. We make use of this fact tacitly in what follows. 

For completeness, we write h without any subscript in the remainder of this proof as an abbreviation 
for l“CDL- Take 0 such that F -i0. We shall prove that 9 is satishable at a locally well-ordered pointed 
plausibility model and then apply Theorem 3.6 to draw the desired conclusion. Our construction is based on 
the completeness constructions given in [5]. Proceeding, provability will always be taken with respect to CDL, 
the language is assumed to be .i^cDL) and we make tacit use of Theorem |3.11[ To say that a set of formulas 


is consistent means that for no finite subset does the conjunction provably imply T. For sets S and S' of 
formulas, to say that S is maximal consistent in (or “maxcons in”) S' means that S C S', S is consistent, 
and extending S by adding any formula in S' not already present would yield a set that is inconsistent (i.e., 
not consistent). Given a formula (p, we write sub((^) to denote the set of sub-formulas of y?, including (p 
itself. We extend this definition to sets of formulas: for a set S of formulas, sub(S) := IJ^g^ sub((^). Given 
a set S of formulas, we write ©5 to denote the Boolean closure of S (with respect to the language): this 
is the smallest extension of S that contains all Boolean constants that are primitive to the language (i.e., 
T) and is closed under all Boolean operations that are primitive to the language (i.e., implication). Since 
our language is Boolean complete (i.e., every Boolean constant and every Boolean connective is definable 
in terms of the Boolean constants and Boolean connectives primitive to the language), it follows that the 
Boolean closure ©S' of S is the smallest extension of S that contains all definable Boolean constants (i.e., 
T and T) and is closed under all dehnable Boolean connectives (e.g., implication, conjunction, disjunction, 
and negation). For a set S of formulas, we define: 


±S:=SU{^p\p£S} , 

BoS := S , 

Bi^iS := ±{B'^p \ Ip £ S and p £ BiS} , 

B.S:=[jo<i<u.B^S , 

Co :=±sub({ 0 ,T,T}) , 

Cl := ©Co , 

B := B^Ci , 

C:=CiUB . 


Notice that 0 is excluded in the definition of B^^S. Further, Cq is hnite. Since F -^9, we may extend {“'0} to 
a set wg that is maxcons in C. We then dehne: 

VF := {x C C I X is maxcons in C} , 

X := /\(x n Co) for X G W , 

:= {p I B^p G x} for X G VF and 'ijj £ Ci , 

< := {(x, y) G VF x VF | G (x n y n Ci), C x} , 

'F(x) := ^ n X for X G VF , 

M := (VF, <, V) . 

Notice that for x G W, we have x G Ci, from which it follows by the maximal consistency of x in C © Ci 
that X G X. Further, it follows by the definition x = /\(x n Co) and the fact that x is maximal consistent in 
C = Cl U B that for each i/j £ Ci = ©Cq, we have Fx—>-'0orFx— >• Finally, if x < y and x ^ y, then 
it follows by the maximal consistency of x and of y in C that x ^ y and y ^ x and therefore that F x —)■ -ly 
and F y — )• -ix. We make tacit use of the facts mentioned in this paragraph in what follows. 

We prove that W is hnite. First a dehnition due to [8]: to say a set S of formulas is logically finite means 
that S has a finite basis, which is a hnite S' C S satisfying the property that for every y G 5, there exists 
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G S' such that h x It can be shown by a normal form argument that if S is logically finite, then 

there can be only finitely many sets that are maximal consistent in S. So to prove that W is finite, it suffices 
to prove that C is logically finite. Proceeding, since Ci was obtained as the Boolean closure of the finite set 
Co, it follows by a normal form argument that Ci has a finite basis Cj. So for B'^(p G BiCi, since we have 
that 'll) ^ Cl and ip ^ BqCi = Ci, there exists 'll)' G C'^ and ip' G C'^ such that 

h V' ^ and ^ p ^ p' . 

Applying (LE) and modal reasoning, it follows that 

hB^p^B'^'p' . 

Since B'f^'p' G BiC'^ and —<B'^'p' G BiC'^, it follows by classical reasoning that BiC'^ is a finite basis for 
BiCi- Therefore, there exists a finite basis B'^ for ©SiC^. We prove by induction on positive i < u) that the 
set B'^ is also a finite basis for BiCi. The induction base case i = 1 (for has already been handled. 

So let us proceed with the induction step: we assume B'^ is a finite basis for BjCi for each non-negative 
integer j that does not exceed some fixed i > 1 (this is the “induction hypothesis”), and we prove that is 
a finite basis for Bi^iCi. Proceeding, take x £ Bi^iCi. Since i > 1, we have i + 1 > 2 and therefore x has 
one of the forms B'^B^p, B^-iB^p, -<B'^B^p, or B'^^B^p for some p G Bi^iCi. We have by (PR), (NR), 
and classical reasoning that the following “reductive equivalences” obtain: 

h B^B^p GG (R^T V B^p) , 
h ^B^B^p GG {^B^± A -^B^p) , 
h B'f’^B^p GG (R’^T V -RV) , 
h ^B^^B^p GG (^R’^T A rV) • 

R’^T and -iR’^^T are members of RiCi, and B^p and -^B^p are members of RjCi. Since f -|- 1 > 1 and 
i -|- 1 > i, we may apply the induction hypothesis: there exist members (R^T)', (-■R’^T)', (B^p)', and 
{-iB^pY of R( such that the following “inductive equivalences” obtain: 

h R’^T GG (R’^T)' , h ^R’^T GG (^R^T)' , 

h B^p GG (rV)' , h -RV ^ (-^V)' • 

Let us call the four formulas appearing on the right sides of the inductive equivalences the “reduced formulas.” 
Each reduced formula is a member of the finite basis R( for ©RiCi, and therefore each reduced formula is 
also a member of ©RiCi. Since ©RiCi is closed under all definable Boolean operations and R( is a finite 
basis for ©RiCi, it follows that any Boolean combination of the reduced formulas is also a member of ©RiCi 
and therefore that any such Boolean combination is provably equivalent to a formula in R(. But then it 
follows by the inductive equivalences and classical reasoning that the right side of each reductive equivalence 
is provably equivalent to a Boolean combination of reduced formulas, and the latter combination is itself 
provably equivalent to a formula in R(. R follows that our original formula x £ Bi^iC must be provably 
equivalent to a formula in R( as well. Therefore, R( is indeed a finite basis for Rj+iCi. This completes 
the induction step. We conclude that R( is a finite basis for BiCi for each i > 1. As a result, it follows 
that R( is a finite basis for R = B^Ci = Uo<i<tj BiCi. But then CJ U R( is a finite basis for C = Ci U R. 
Conclusion: W is finite. 

Suppose we are given x G W and p G x. If h (/?—)■ ■0 and 'll) G C, then it follows by the maximal 
consistency of x in C that 'll) G C. It is tedious to repeatedly verify membership assertions in C and state 
that the reason the result follows is by the fact that x is maximal consistent in C. Therefore, we adopt the 
convention that we shall generally only write that h —)• 0 and p G x together imply 0 G x. In so doing, we 
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tacitly indicate (and the reader should verify) that € C, x is maximal consistent in C, and so the result 
follows by the maximal consistency of x in C. The reader will always know when such tacit use takes place 
(and requires verification), since this use occurs every time it is stated that a membership assertion ^ G x 
obtains as a logical consequence of some collection of assumptions that does not include the assumption 
■0 G X itself. Finally, for convenience in the remainder of the proof, we shall say that a set is “maximal 
consistent” to mean that it is maximal consistent in C. 

Agreement Lemma: for each {x,y} C W, if 0 G Ci and x'^ C y, then x H B = y n B. We prove this 
now. Proceeding, assume 0 G Ci and x^ C y. If B^(p G x, then B^B^cp G x by (PI) and therefore B^p G y 
by x'^ C y. So B^p G x implies B^p G y. Now suppose B^p G y. If we had B^p ^ x, it would follow 
by maximal consistency that -^B^p G x, hence B'^—<B^p G x by (NI), and hence ^B^p G y, contradicting 
the consistency of y because B^p G y. So B^p G y implies B^p G x. Conclusion: the Agreement Lemma 
obtains. Note that we obtain from this lemma by the definition of < that that x < y implies xDB = yCiB. 

We prove that < is reflexive. By the definition of <, it suffices to prove that x^ C x. Proceeding, since 
B^p G X implies B^p £ B = Uo<i<aj ^i^i, all we need do is prove by induction on i > 1 that B^p G xfiBiCi 
implies p £ x. 

• Induction base; B^p G x H BiCi. 

We have p £ Ci and hence hx—)-(/?orl-x—)• -^p. If h x —)• ^p, then it follows by (SC) that 
B^—<p £ X. Since we also have B^p £ x, we obtain by modal reasoning that G x, from which it 
follows by (WCon) that —<x G x, a contradiction. Therefore it follows that \- x ^ p and hence p £ x. 

• Induction step: we assume the result for i = 1,..., A: and we prove the result for f = A: + 1. 

Assume B^p £ x£\Bj.j^iCi. Since A: > 2, it follows that p = B'^x oi p = ^B'f’x- Therefore, by (PR) or 
(NR) we have y p £ x. As in the induction base, it follows by (WCon) that R^T ^ x. Therefore, 

p £ X. 

Conclusion: < is reflexive. 

We prove that < is transitive. Proceeding, assume x < y < z. This means there exists a G (x n y n Ci) 
and b £ {y H z H Ci) such that y“ C x and z^ C x. It follows that aV b £ {x Ci z H Ci), and so to conclude 
X < z, it suffices for us to prove that 2:“^^ C x. Proceeding, we take an arbitrary B^'^^p £ x and we seek to 
prove that p £ z. We consider two cases. 

• Case: R“^^-ia G 2. 

Since V 6 ) G 2 by (Succ), it follows by the assumption of this case and modal reasoning that 

G 2 . Applying the latter and the assumption of the case again, we obtain by (CM) that 

Q{aWb)Ab 

-■a G 2 , from which it follows by (LE) that B^^a £ z. But z^ C y and therefore -lO G y. Since 
a £ y, we have reached a contradiction. So this case cannot obtain, and so there is nothing more to 
prove. 

• Case: -iR“^^-ia G 2. 

From the assumption of this case and B^'^^p £ z we obtain by (RM) that G 2. Applying 

(LE), it follows that B°'p £ z. Hence B^B°'p G 2 by (PI). Since z^ C y, it follows that B^-p £ y. Since 
y“ C X, we obtain p £ x. 

Conclusion: < is transitive. 

We prove that < is total on each connected component. Proceeding, suppose we have w £ W and 
(x,y) G cc{w) X cc{w). Since x G cc{w) and y G cc{w), it follows that v < w or w < v ioi each v £ {x,y}. 
Applying the definition of < and the Agreement Lemma, we obtain x H R = y H R. We wish to prove that 
X < y or y < X. We consider two cases. 
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• Case: G x n y. 

By (Succ), we have B^'^y{x V y) G x n y. Applying the assumption of this case and modal reasoning, 
we obtain B^'^yy G x n y. We shall now prove that y < x. Proceeding, take an arbitrary B^'^y(p G x. 
It follows from this by B^'^y-y G x and (CM) that B^^'^y^^yip G x. Applying (LE), we obtain By(p G x. 
Since x D B = ynB, we have B^ip G y. But we saw in the argument for reflexivity that yy ^ y and 
therefore (p ^ y. So we have proved that for an arbitrary Byp G y, we obtain (p G y. That is, we have 
shown that x*^^ C y. Since x V y G (x C y C Ci), it follows that y < x. 

• Case: ^B^'^y^x G x n y. 

We prove that x < y. Proceeding, take an arbitrary B^'^yp G y. It follows from this by the assumption 
of this case and (RM) that G y. Applying (LE), B^p G y. Since y n B = x n B, we obtain 

G X. But we saw in the argument for reflexivity that x® C x and therefore p G x. So we have 
proved that for an arbitrary B^'^yp G y, we obtain p G x. That is, y^^® C x. Since xVy G (xCynCi), 
it follows that x < y. 

Conclusion: < is total on each connected component. 

Since wq G IT, it follows that IT is nonempty. Therefore, < is a reflexive and transitive binary relation 
over the nonempty finite set IT, and < is total on each connected component. It follows from the finiteness 
of IT that < is well-founded. Therefore, M is a locally well-ordered plausibility model. We now prove a few 
lemmas that will be of assistance. 

Consistency Lemma: for each x G IT, li if) G x, then x^ is consistent. We prove this now. Proceeding, 
suppose x'^ is not consistent. It follows that there exists a nonempty {xi^ ■ ■ ■ ■:Xn} ^ x^ such that h 
{l\i<nXi) T. By modal reasoning, h (Ai<n-^^ m) B^L. Since Xi ^ and hence B^Xi £ x for each 
i < n, it follows that B^L G x. Applying (WCon), -■V’ G x, which contradicts the consistency of x because 
we assumed ip G x. Conclusion: x'^ is consistent. 

Minimality Lemma: for each ip G Ci and x G [ip], where 

[ip] := {x GW \ Ip G x} , 


we have x G min[^/:] iff -^B'^^x G x. 

• Left to right: for ip G Ci and x G [ip], we prove x G min[^/:] implies -■B’^-ix G x. 

Assume ip G Ci and x G min['0]. Toward a contradiction, suppose B'^^x G x. Applying the Con¬ 
sistency Lemma, x^ is consistent and so may be extended to a maximal consistent y G IT. Since 
B'^ip G X by (Succ), it follows that ip G y. And since B'^^x G x, it follows that -ix G y and therefore 
that y ^ x. But then ip G (x n y H Ci) and y’^ C x, from which it follows that y < x. Since y G [ip], 
y < X, and x G min['0], it follows that x < y. That is, there exists d G (x n y n Ci) such that y^ C x. 
Now if we had B^—i5 G x, then it would follow that ->d G y, contradicting the fact that S G y. Hence 
G X. Since B^-ix G x as well, it follows by (RM) and (Comm) that B^^'^^x G x. Applying 
(Inc), B^{ip —)■ -ix) G X. Since x < y implies x H B = y n B, it follows that B^{ip -G -<x) G y, from 
which it follows by y^ C x that ip -G -ix G x. Since ip G x, we obtain -ix G x, a contradiction. Our 
assumption B’^-ix G x must have been incorrect, and so we must have —iB^—ix G x after all. 

• Right to left: for ip G Ci and x G [ip], we prove -<B^-<x G x implies x G min['0]. 

Assume ip G Ci, x G [ip] and, ^B'^^x G x. It suffices to show that for each y G [A] O cc(x), we 
have X < y. Proceeding, take an arbitrary y G [ip] (1 cc(x). It follows that y n B = x n B and that 
Ip G [x n y n Cl). So from ^B'^^x G x we obtain -iB^-ix G y. Now take an arbitrary B'l^p G y. It 
follows from this and -■B’^-ix G y by (RM) that B^^^p G y. Since ip G x H Ci, we have h x —)• ■0 and 
therefore it follows by (LE) that B^p G y. Since x H B = y n B, we obtain B^p G x. However, we 
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saw in the argument for reflexivity that C x, so it follows that (/? G x. That is, we have shown that 
G (x n y n Cl) and y'^ C x. Hence x < y. Since y ^ [ip] H cc{x) was chosen arbitrarily and x ^ [ip], it 
follows that X G min['!/)]. 


This completes the proof of the Minimality Lemma. 

Truth Lemma: for each (p G Ci, we have [ip] = We prove this now. The proof is by induction on 

the construction of formulas in Ci. The induction base case and Boolean induction step cases are standard, 
so we only consider the induction step case for formulas G Ci. Note: by the definition of Ci, we have 
B'^p G Cl iff B'^p G Cq. Further, from B'l^p G Cq, it follows by the definition of Cq that ip £ Cq and p G Cq. 


Induction step B'^p (left to right): if x G IT and B'^p G x n Ci, then M, x |= B'^p. 

Assume B^p G x H Ci. If min[[?/:]] n cc(x) = 0, then, since M is well-founded, the result follows 
immediately by Theorem 3.4, So assume minJV’]] ncc(x) 7 ^ 0 and take an arbitrary y G min[[^/:]] ncc(x). 
Applying the induction hypothesis, y G min['(/^], from which it follows by the Minimality Lemma that 
-^B^^y G y. Since y G cc(x) implies x n B = y n B, it follows that ^B'^^y G x. It follows from this 
by the assumption and (RM) that B^^^p G x. Since ip G y n Ci, we have \- y ^ ip and therefore it 
follows from B'^^^p G X by (LE) that B^p G x. Since x n R = y n R, we have B^p G y. But as we saw 
that C y in the argument for reflexivity, it follows that p £ y and hence that y G [y?]. Applying the 
induction hypothesis, y G [y?]]. Since y G min[['0]] H cc(x) was chosen arbit rarily, we have shown that 
min[[?/)]] n cc(x) C [y?]]. Since M is well-founded, it follows by Theorem 3.4 that M,w ^ B'^p. 


Induction step B^p (right to left): if x G IT, B^p £ Ci, and M,x ^ B'^p, then B'^p £ x. 

Assume B'l^p £ Ci and M,x ^ B'^p. Since M is well-founded, it follows by Theorem 
min[[?/)]] n cc(x) C By the induction hypothesis, min[V'] n cc(x) C [p\. We wish to prove that 

B^p £ X. We consider two cases. 


3.4 


that 


Case: min[^/)] n cc(x) = 0. Since M is well-founded, it follows that [ip] n cc(x) = 0. Toward a 
contradiction, assume B^L ^ x. Now if x'^ were not consistent, then there would exist {xi,..., Xn} ^ 
x'^ such that h (Ai<n Xi) T, from which it would follow by modal reasoning and the fact that 
B^X^ £ X for each i < n that B'^L £ x, contradicting our assumption that ^ X. So x'^ is 

consistent after all, and we may extend this set to some y G IT. Since B'^ip G x by (Succ), it follows 
that Ip £ y and therefore that y £ [ip]. But [ip] H cc(x) = 0, and so we must have that y ^ cc(x). 
However, x'^ C y, so it follows by the Agreement Lemma that xPlB = yPlB and hence x*^^ = y*^^. If 
x^'^y were not consistent, then there would exist {xi, ■ ■ ■, Xn} ^ x*^® such that h (Ai<n Xi) T, from 
which it would follow by modal reasoning and the fact that B^'^^Xi ^ ^ for each i < n that £ x, 

from which we would obtain by (WCon) that -■(x V y) G x and hence that -ix G x, a contradiction. 
So x^'^y = y^'^y is consistent and so may be extended to some 2 ; G IT. By (Succ), B^^^(x V y) G x n y 
and therefore xVy£z. But then xVyG (xriynzHCi), x^^^ C z, and y*^^ C z] that is, 2 ; < x 
and z < y, from which it follows that y G cc(x), a contradiction. Therefore our original assumption 
that ^ X must have been incorrect, and so we must have B'^T G x after all. Applying modal 

reasoning, we obtain B'^p £ x, as desired. 

Case: min[^/:] n cc(x) 7 ^ 0. It follows that there exists y G min[V’] H cc(x). Toward a contradiction, 
assume B^p ^ y. If y'^ U {^p} were not consistent, then we would have a finite {xi,..., Xn} C y'^ 
such that h (Ai<n Xi) p, from which it would follow by modal reasoning and the fact that B'^Xi £ U 
for each i < n that B'^p £ y, contradicting the consistency of y by our assumption that B^p ^ y. 
So y'^ U {^p} is indeed consistent and may be extended to some 2 ; G VT. Since we have B'^ip G y by 
(Succ), it follows that ip £ z Ci y H Ci. So since y'^ C 2 ;, it follows that z < y. But then z < y, ip £ z, 
and y G min[V'] ncc(x), so it follows that 2 : G min[V’] n cc(x). Since min[V’] H cc(x) C [p], it follows that 
p £ z. However, by the construction of 2 ; as a maximal consistent extension of y^ U we also have 
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£ z. So z is inconsistent, a contradiction. It follows that our assumption £ y must have 

been incorrect and therefore we must have B'^ip £ y after all. Since y £ cc(a:), we have B = y n S 
and therefore that B'^ip £ x, as desired. 


This completes the proof of the Truth Lemma. Since ^6 £ we CiCi, it follows by the Truth Lemma that 
M,wg ^ 9. But then we have shown that T 6 implies M ^ 6 for our locally well-founded model M £^l. 
Applying Theorem 3.6, T 6 implies ^ ip. By contraposition, we have that |= 6 implies h 6. So completeness 
obtains. □ 


A.3 Results for AGM revision 

Proof of Theorem 4-1. For assume T £ iBcpL is consistent. To say a S is maximal CPL-consistent means 
that S C .ifcPL; S is consistent, and adding to S any if £ .SfcPL not already present would result in a set 
that is inconsistent. We make tacit use of various well-known facts about maximal consistent sets. Let S 
be the collection of all maximal CPL-consistent sets. Let {V'i}o<i<aj be an enumeration of .i^cPL- Define 
:= uj — {0} and S + if '■= CPL(5 U {if}). Take 


W := {(5,0) E 6 X {0} I T C ,9} U 

{(5,i) £exuj+ I ^ifi£T- CPL(0) and CPL(V’i) C Sj , 
< := {((5, i), (S', i')) £W xW \ i<i'} , 

V := {((5, i), P)£W X p(^) \P = Sn^} , 

M := (W,<,V) . 


Since T is consistent, it follows that there exists S £ & such that S DT, which implies (S, 0) £ W. Therefore 
VF 7 ^ 0. Similarly, if i E w"*" and —<ifi £ CPL(r) — CPL(0), then it follows that ifi is consistent and therefore 
there exists S £ & such that S 'D CPL(^/;j), which implies (S,i) £ W. The relation < on VF is a well-order 
because the relation < on cj is a well-order. So M is a well-ordered plausibility model. 

Truth Lemma: for each ip £ .ifcPL and (S, i) £ W , we have M, (S, i) |= <y9 iff y? E S. The proof is by 
induction on the construction oi ip £ .i?cPL- Induction base: ip = L, then T ^ 5 since S is consistent and 
M, (S,i) ^ T by Definition 3.2 Induction base: if (^ = p E then the result follows by the definition of 
V and Definition 3^ Induction step: if (p = (pi —)• (p 2 , then the result follows by the induction hypothesis 
and Definition 


The lemma follows. 

Theory Lemma: for each if £ .J^cpL; we have 


M'*' *M if 


T + if if -^if ^ T, 

< CPL(V’) if-V’er-CPL(0), 
.^CPL if-V’GCPL(0). 


We prove this now by a case distinction. Proceeding, for each W' C VF, define 

r(VF') := [ip £ ^cDL \ 'iw £W' : M,w\=ip] . 

• Case: -^if ^ T. 

Let := {S £ & \ S D T U {V’}}- It follows by the assumption of this case that ^ 0 and hence 
©V’ ^ {b} ^ bF- Dy the Truth Lemma and the dehnition of <, it follows that minlji/^jM = ©i/; ^ {0}- 
Now notice that since S £ ©^ is maximal CPL-consistent, it follows that for each S' <£ S we have 
CPL(iS") C S. Therefore, since T U {if} C S for each S £ ©^, it follows that T + if T S ioi each 
S £ ©^. So T + if C f) ©^. Now if we had some (p E H ©^ such that ip ^ T + if, then it would 
follow that ip CPL(ru {V'}) and therefore we could extend TU{if, -Kp} to a maximal CPL-consistent 
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S G having (p ^ S, contradicting the fact that p G Therefore it must be the case that 

nsb C T + '0- Hence T + 0 = f] But then we have 

T{&^ X {0}) = = T + Ip , 

where the leftmost equality follows by the Truth Lemma. Since min[[0]]M = ©v ^ {h}) h follows by 
the definition of *m that Aft *m 'ip = T + ip. 

• Case: ^0 G T - CPL(0). 

Define := {5 G © | 0 G S'}. It follows by the definition of W that there exists j G and S G ©^ 
such that ipj = Ip and {S,j) G W. So let i G oj~^ be the least positive integer satisfying the property 
that there exists (5, f) G IT with ip € S. By the Truth Lemma, the definition of <, and our choice of i, 
it follows that min[[0]]jvf = ©i/; x {i}. Since S G ©^ is maximal CPL-consistent, it follows that for each 
S' C S we have CPL(S") C S. Therefore, since 0 G S' for each S G ©^, it follows that CPL(0) C S 
for each S G ©.</,. So CPL(0) C T we had some p G f} such that p ^ CPL(0), then we 

could extend {ip,^p} to a maximal CPL-consistent S G having p ^ S, contradicting the fact that 
(/? G n ©^. Therefore it must be the case that P| ©^ C CPL(0). Hence CPL(0) = P| ©^. But then we 
have 

r(©^x{i}) = n©v. = cPL(0) , 

where the leftmost equality follows by the Truth Lemma. Since min[[0]]M = ©i/i x {ij, it follows by 
the definition of *m that M-^ *m ip = CPL(0). 

• Case: ^0 G CPL(0). 

It follows from —up G CPL(0) by the soundness of Classical Propositional Logic that ^ ip and therefore 
min|{0]]M = 0- Hence min[[0]]A4' C \p\m for each p G .ifcPL- Applying the definition of *m-, it follows 
that Aft *M Ip = -^CPL- 

The lemma follows. 

We now prove that AL is a Grove system for T. First, since Aft = Lq, it follows by the Theory Lemma 
that Aft = T. Second, we have already seen that Af is a well-ordered plausibility model. So all that remains 
is to prove that Aft ) satisfies the ACM revision postulates. So given an arbitrary ip G -^cpL; we check 
each postulate in turn. 

• Closure: Aft 0 = CPL(Aft 0). 

By the Theory Lemma, Aft -ip is either T -|- 0, CPL(0), or ..Sfcpi- However, for each of these sets S, 
we have CPL(5) = S. 

• Success: ip G Aft 0. 

By the Theory Lemma, Aft 0 is either T + ip, CPL(0), or ..^fcPL- However, each of these sets 
contains ip. 

• Inclusion: Aft 0 C Aft -|- 0. 

By the Theory Lemma, Aft ip is T + ip if -up ^ T, is CPL(0) if -up G T — CPL(0), and is 
■^CPL if ~^ip G CPL(0). Further Aft = T. Inclusion obviously follows for the case -^ip ^ T. for the 
case -10 G T — CPL(0), Inclusion follows because CPL(0) C T -|- 0 = CPL(T U {0}). For the case 
-10 G CPL(0), Inclusion follows because T + ip = CPL(r U {0}) = .ifcPL- 

• Vacuity: if -<ip ^ Aft, then Aft ip = Aft -|- ip. 

Since Aft = T, the result follows by the Theory Lemma. 
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• Consistency: if ^ CPL(0), then _L ^ CPL(M'I' *m 'P’)- 

If -■V’ ^ CPL(0), then either ^ T or -■'0 G T — CPL(0). Applying the Theory Lemma, M'*' *m 0 
is either T + 0 or CPL(0). Since T is consistent and we assumed 0 is consistent, each of T + 0 and 
CPL(0) is consistent. Hence T ^ CPL(M'*' *m 0 )- 

• Extensionality; if (0 -H- 0') G CPL(0), then M'*' *m 0 = *m ip'- 

Assume (0 <-)• 0') G CPL(0). It follows that T + 0 = T + 0' and CPL(0) = CPL(0'). The result 
therefore follows by the Theory Lemma. 

• Superexpansion; M'*' *m (0 A (/?) C (M'*' *m 0 ) + 

Case: -i(0 A (/?) ^ T. By the Theory Lemma, M'*' (0 A (^) = T + (0 A (/j). Since T is a theory, it 

follows from the assumption of this case that -10 ^ T. Applying the Theory Lemma, = T + 0. 

The result follows because 

r + (0 A (^) = cPL(r u {0 A if]) = cPL(CPL(r u {0}) u {y?}) = (t + 0) + (^ . 

Case: -i(0 A(p) G T — CPL(0). By the Theory Lemma, M'*' *m {'ip A(p) = CPL(0 A tp). If -10 ^ T, then 

it follows by the Theory Lemma that M'*' *m ip = T + and hence 

CPL(0 A C CPL(r U {0, if}) = CPL(CPL(r U {0}) U {(/?}) = {T + iP) + p . 

And if -10 G T — CPL(0), then it follows by the Theory Lemma that M-^ *m 0 = CPL(0) and hence 

CPL(0 A (p) = CPL({0} U {v?}) = CPL(0) + p. Finally, if ^ip G CPL(0), then it follows by the Theory 
Lemma that M'*' *m ip = -^cpL; from which we obtain 

CPL(0 Ap) = .ifcPL = -^CPL + ^ ■ 


Case: -<{ip A p) G CPL(0). By the Theory Lemma, M'*' *m {ip f\p) = -^cpl- If ~'ip ^ T, then it follows 
by the Theory Lemma that M-^ *m ip = T + ip', however, since p Aip G {T + ip) + p, it follows from the 
assumption of the case that {T + ip) + p = ^cpl, which implies the result. And if ^ip gT - CPL(0), 
then it follows by the Theory Lemma that M-^ *m ip = CPL(0); however, since p Aip G CPL(0) + p, 
it follows from the assumption of the case that CPL(0) + p = ^cpl, which implies the result. Finally, 
if —'Ip G CPL(0), then it follows by the Theory Lemma that M-^ *m ip = -^cpl and the result follows 
because .ifcPL + P = ^cpl- 

• Subexpansion: if -^p ^ CPL(M'*' *m ip), then (M'*' *m ip) + P ^ *m {ip ^ p)- 
Suppose ->p ^ CPL(M'*' *m ip)- We consider a few cases. 

Case: ^ip ^ T. By the Theory Lemma, CPL(M'*' *m ip) = CPL(T + 0) = T + 0. If -i(0 Ap) ^ T, then 
it follows by the Theory Lemma that M'*' *m {ip A p) = T + {ip A p), from which we obtain the result 
because 

{T + ip) + p = cPL(CPL(r u {0}) u {(/?}) = CPL(r u { 0 } u {(^}) = cPL(r u {0 a (/?}) = r + (0 a (^) . 

And if -1(0 A (/?) G T — CPL(0), then we have {T + ip) + p = ^cpl by the definition of +; however, 
we originally assumed that -ip ^ CPL(M'I' ip) = T + 0, which implies {T + ip) + p ^ ..^^cpL) a 
contradiction that allows us to conclude that the hypothesis ^{ip A p) G T — CPL(0) cannot obtain 
under the assumption of this case. Finally, if -^{ip Ap) G CPL(0), then it follows by the Theory Lemma 
that M'*' *M {ip ^ p) = -^CDL, which trivially implies the result. 
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Case: G T — CPL(0). By the Theory Lemma, CPL(M'I' *m V') = CPL(CPL(^/))) = CPL('0). Since 

T is a theory, it follows from the assumption of this case that -■(?/' At/?) G T — CPL(0). Applying the 
Theory Lemma, *m ('*/’ A </?) = CPL('!/) A ip). But then the result follows because 

CPL(V’) + p = CPL(CPL(V^) U {(/?}) = CPL({V^} U {(/?}) = CPl{ij A ip) . 

Case: ^'tjj G CPL(0). By the Theory Lemma CPL(M'*' *m i’) = CPL(^cpl) = -^cpl- It follows from 
the assumption of this case that A p) G CPL(0). Applying the Theory Lemma, Aft *m 4’ = -^cpl- 
The result follows. 

Conclusion: M is a Grove system for T. 

For 0 . if T is inconsistent, then since M* is a system of spheres, it follows that T * (—) = M* *m (—) 
satisfies the AGM revision postulates. And if T is consistent, then since T*?/? = T *Mt 4 is a Grove 

system for T, we have Aft = T and that Af is a system of spheres; therefore, T *Mt (“) = T * (—) satisfies 
the AGM revision postulates. Conclusion: * is an AGM revision operator. □ 


A.4 Results for JCDL 


Proof of Lemma 5.5. For this argument, a derivation is a JCDL-derivation. We wish to establish the follow¬ 
ing result: 

^ ^JCDL P dTT* D TT, TT* h^CDL P ■ (10) 


The proof of (10), an adaptation of 13 Lemma 4.6] to the present setting, is by induction on n with a 
sub-induction on the length |7r| of vr. 

• Induction base: n = 0. Take vr* = vr. 


• Induction step: assume the result holds for all m < n (this is the “induction hypothesis”), and prove 
it holds for n by a sub-induction on |7r|. 

Sub-induction base: |7r| = 1. Since vr contains a single line, p is an axiom and therefore vr Pjcdl p. 
Take tt* = vr. 


Sub-induction step: assume the result holds for all derivations tt' having \tt'\ < |7r| (this is the “sub¬ 
induction hypothesis”), and prove it holds for tt. Proceeding, assume vr Pjcdl P- I^ ^jcdl 
done. So let us assume further that vr p. Therefore 

TT = 01, . . . ,0|^|_1,</? 

contains at least one troublesome necessitation. It follows that there exists a shortest prefix vr' of tt 
whose last line is a troublesome necessitation: we have 

7r' = 0i,...,0|,,|_i,B'50^ 

with Ivr'l the minimum value such that B^9m neither is not a possibly necessitated axiom nor follows 
from a previous line by (MP). We consider two cases. 

Case: \ti'\ < |7r|. By the sub-induction hypothesis, there exists 7r( D vr' such that 7r( Pj^ql B^Om- Let a 
be the suffix of tt such that vr'a = vr, where we have denoted sequence concatenation by juxtaposition. 
Since 7r( is a derivation and vr]) 3 vr', it follows that 7r])cT is a derivation and this derivation has the 
same last line as vr. Therefore, since we chose vr' as the shortest prefix vr' of vr whose last line is a 
troublesome necessitation, we have vr(,cj Pjcdl P- ^PPly^S iLe induction hypothesis, it follows that 
there exists a derivation vr* D vr'cr A vr'cr = vr such that vr* p. 
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Case: vr' = vr. Hence tp = B^Om- Since the shortest prefix of vr whose last line is a troublesome 
necessitation is vr itself, it follows that vr B^Om- But then 9m is not a troublesome necessitation. 

Moreover, 9m is not a possibly necessitated axiom (since if it were, B^9m would not be a troublesome 
necessitation, contrary to our assumption implying that it is). So 9m must follow by way of (MN) from 
lines 9n —)• 9m and 9n appearing earlier in tt than line m. That is. 


vr — CT, 9 m j T , X 9 m 

with both 9n —)• 9m and in a 


where a and r denote sequences of formulas (and we note that r may be empty). By (eMN), we have 
derivations 

vr^ = a,B^9n with |7r^| <m < |7r| 

vr^ = a, B^{9n —> 9m) with |7r^| <m< |7r| 

such that TT^ l“jcDL and I“jcdl ^ ^m)- Applying the sub-induction hypothesis to vr^ 

and to TT^, there exist D tt^ and vrj 3 vr^ such that vr^ ^jcDL and ttJ ^JCDL Om)- 

Recalling the abbreviation B^x = making use of an instance of (eK), the sequence 

"T, 

B^{Gn ^m) {B^Gn —>• {cOn^dm ' ^6n) •'^^m)) 

B^&n {Cdn^dm ■ ^0„) 

{cen^em ■ ^dn) ' 


is a derivation satisfying tt* D tt and vr* p. 


This completes the proof that (10) holds 


□ 


Proof of Theorem 5.6. In light of Lemma 5.5, to prove the statement of the present theorem, it suffices to 
prove the following: if bj(-p|_ p, then there exists a logical term t such that t :^p. This we prove by 

induction on the length of derivation. 


• Induction base and induction step for (eMN): is a possibly necessitated axiom. It follows that 

hjcDL Cif, for the logical term c^p. 

• Induction step for (MP): we assume Ljcdl T ^ and Ljcdl T along with the following “induction 

hypothesis”: there exist logical terms t and s such that Ljcdl V') and Ljcdl s:^p. But then 

it follows by the induction hypothesis, (eK), and two applications of (MP) that Lj^ql {t ■ s) for the 
logical term t ■ s. 


The result follows. 


□ 


Proof of Theorem 5.9. For Item[^ we prove by induction on the length of derivation in JCDL from hypotheses 
P that 


F bjcDL T implies F° hcDL T° ■ 

• Induction base for hypotheses: if y? G F, then p° G F°. So F° Pcdl ■ 


• Induction base for axioms: p is an axiom. But for each axiom scheme (eA) of JCDL for which there is a 
“matching” axiom scheme (A) of CDL, the forgetful projection of an instance of the JCDL axiom is an 
instance of the matching CDL scheme. Regarding the three remaining JCDL schemes (eSum), (eCert), 
and (eA) that have no matching CDL scheme: each of (eSum) and (eCert) is mapped to an instance 
of the CDL-theorem p ^ p, and (eA) is mapped to an instance of the CDL-theorem q ^ {p ^ p). 
Conclusion: F° PcDL ■ 
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• Induction step for (MP): we assume the result holds for JCDL-theorems (/?—>■ '0 and (p derived from 
hypotheses P, and we prove that r° Pcdl 4^°■ By our assumption, ip° — ?• ^l^° and p>° are CDL-theorems 
derived from hypotheses r°. Applying (MP), 11)° as a CDL-theorem derived from hypotheses r°. 

• Induction step for (eMN): we assume the result holds for the JCDL-theorem p) derived from hypotheses 

r, and we prove that the result holds for the JCDL-theorem derived from hypotheses P; that is, 
we prove that r° Pcdl ■ By our assumption, p° is a CDL-theorem derived from hypotheses 

r°. Applying (MN) and the definition of the forgetful projection, B'^°p° = {B'^p)° is a CDL-theorem 
derived from hypotheses in r°. 

This completes the proof of Item[^ For Item[^ we by induction on the length of derivation in CDL from 
hypotheses A that 

A hcDL tp implies A* Pjcdl V’* ■ 

• Induction base for hypotheses: If ip £ A, then ^p^ G A*. So A* Pcdl V'*- 

• Induction base for axiom scheme: ip is an axiom scheme of CDL, so we consider each possibility. 

— (CL)* is an instance of (CL) and therefore a JCDL-derivable from hypotheses A*. 

— (K)* is the scheme {p\ —)> p\) —)• p\ —>■ p\). This has the form 

B\xi ^ X2) ^ {B\i ^ 3^2) . 


Applying (eK), we obtain 

A^ L JCDL X2) {B^Xi ( )-^X 2 ) ■ 

Applying (eCert) and classical reasoning, 

A* Ljcdl B^ixi —^ X2) — > {B^Xi —^ B^X2) ■ 

That is. A* Ljcdl (K)*. 

— For X G {Succ, RM, Inc, Comm, PI, NI}: (A)* is a schematic instance of (eA). 

— Similar to the argument for (K)*: 

* (KM)* follows by (eKM) and (eCert), and 

* (WCon)* follows by (eWCon) and (eCert). 

• Induction step for (MP): we assume the result holds for the CDL-theorems pi —>• p 2 and pi derived 
from hypotheses A, and we prove the result holds for the CDL-theorem p2 derived from hypothesis A. 
By our assumption, 

{pi -£■ p 2 f = Pi^ P 2 and p\ 

is a JCDL-theorem derivable from hypotheses A*. So it follows by (MN) that p\ is a JCDL-theorem 
derivable from hypotheses A* as well. 

• Induction step for (MN): we assume the result holds for the CDL-theorem p derived from hypotheses 
A, and we prove the result holds for the CDL-theorem B'^p derived from hypotheses A; that is, we 
prove that A* Ljcdl {B'^pY- By our assumption, the formula p^ is a JCDL-theorem derived from 
hypotheses A*, but then it follows by (eMN) that B^ p^ = {B'^pY. is a JCDL-theorem derived from 
hypotheses A*. 

This completes the proof of Item □ 
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Proof of Theorem 5.19. This proof uses much of the work from the proof of Theorem 3.13 (the “old proof”). 
In utilizing portions of the argument from the old proof in the present argument (the “new proof”), we 
adopt the following conventions (the “JCDL-conventions”): 

• the language (and set of formulas) is assumed to be .i^jcDLi 

• occurrences of “i? ” from the old proof are replaced by occurrences of “i? ”; 

• truth or validity for CDL is replaced by truth or validity for JCDL; 


use of Theorem 3.4 or 3.4 is replaced by use of Theorem 5.16 


use of Theorem 3.6 is replaced by Theorem 5.18 


derivability in CDL is replaced by derivability in JCDL 
use of the non-subscripted turnstile h denotes Kjcdl; 
use of Theorem 3.11 is replaced by Theorem |5. lit ^md 


• use of a derivable principle (X) of CDL (perhaps by tacit use of Theorem 3.11) is replaced by use of the 
corresponding derivable principle (eX) of JCDL (with corresponding tacit use of Theorem 5.11 when 
appropriate). 

Having established the above JCDL-conventions and the “old/new proof” terminology, we proceed. 

For soundness, we proceed by induction on the length of derivation. In the induction base, we must show 
that each axiom scheme is valid. (CL) is straightforward, so we proceed with the remaining schemes. Let 


(M, w) be an arbitrary well-ordered pointed Fitting model. We make tacit use of Theorems 2.3 3) and 5.15 


(eCert) is valid |= t :'^ip —>■ 

Assume {M,w) satisfies Then w G A{t,ip) and minj'i/’]] C [[(yj]]. Applying Theorem 5.16 {M,w) 

satisfies 

(eK) is valid: |= t —>■ ^ 2 ) —^ (s {t ■ s):‘^p 2 )- 

Assume {M,w) satisfies — )> P 2 ) and s:^pi. Then w G A{t,pi — >■ P 2 ) Cl A(s,(/Ji), min|{'0]] C 

[(yji —)• (/92]], and minj^/l]] C [[(yJi]]. Hence min[['0]] C \p 2 \ and, by Application (Definition 5.12), w G 
A{t-s,p 2 )- Conclusion: {M,w) satisfies {t ■ s):^p 2 - 

(eSum) is valid: |= {t :'^p V s :'^p) {t + s) :'^p. 

Ass ume ( A/, w) satisfies t:^p\/ s:^p. Then w G A{t,p) U A(s,(y9) and min|{V^]] C [[(yj]]. By Sum (Defini¬ 
tion 


5.12), w G A{t + s,p). Conclusion: {M,w) satisfies {t + s) :'^p. 

(M, w) satisfies B'^ip. 


(eSucc) is valid: |= B'^f). 

We have minj'i/^]] C [[?/)]]. Applying Theorem 


5.16 


(eKM) is valid: |= 

Assume {M,w) satisfies t:^-L. Then w G A{t,l.) and minJV’]] C [Tj. It follows from the latter by the 
old proof that minJV' A (yjJ C [Tj. Conclusion: (M, w) satisfies t 


(eRM) is valid: \= —)• (t :^x t 
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Assume (M, w) satisfies and t:^X- 


Since it follows by Certification (Definition 5.12) that min|{'0]] ^ [f/?]]. And it 

follows from t that w G A{t,x) min[[^]] C [xj. By the old proof, we have by min[['0]] ^ [[(/j]] and 
minj'i/;]] C [xj that minJV’A (/?]] C [xj. Since w G A{t,x), we conclude that {M,w) satisfies t:'^^‘^x- 


(einc) is valid: |= t :^^‘>°x —>• B'^{(p — x)- 

Suppose {M,w) satisfies Then w G A{t,x) minJV’A (/?]] C [xj. It follows from the latter by 

the old proof that min[[^]] C [y? —)■ xl- Conclusion: {M,w) satisfies B^{ip —)■ x)- 


(eComm) is valid: \= t :'^^‘^x —^ t :‘^^’^x- 

Suppose {M,w) satisfies t:'^^‘^x- Then w G A{t,x) and min[[?/) A C [xj. Hence min[[(^ A-0]] C [xj. 
Conclusion: {M,w) satishes 


(ePI) is valid: |= t :^x :^x)- 

Suppose {M,w) satisfies t:^x- Then w G A{t,x) and min[[^/)]] C [xj. The latter implies that {M,v) 
satisfies B'^x for any given v G W. Since M is well-ordered, we have v G cc{w) for each v G W, and 
therefore it follows from w G A{t,x) by Admissibility Indefensibility (Definition |5.12[) that A (t, x) = W. 


But then for each v G W, we have v G A{t,x) and M,v ^ B'^X- Applying Theorem 5.14, we have for 
each u G VP that M, v h = t :'^x- Therefore, [[t '.'^x\ = ^ i from which it follows that min[[(/?]] C It :^xl 
Applying Theorem 


5.16 


we conclude that {M,w) satisfies B‘^{t:'^x)- 


(eNI) is valid: ^ -if :^x B‘^{^t :^x)- 

Suppose {M,w) satisfies -<t:^x- Then w ^ A{t,ip) or minj'i/;]] ^ [x]]. 

Case: w ^ A{t,(p). Since M is well-ordered, we have v G cc{w) for each v G VP, and so it follows from 
w ^ A{t,(p) by Admissibility Indefensibility (Definition 5.12) that A{t,(p) = 0. Therefore, |I“'t:^xl = fT, 
from which it follows that min|{:/5]] C [[-'t :^xl- Applying Theorem 

B^(-C^X). 


5.16 


we conclude that (M, w) satisfies 


Case: min[[^]] ^ [x]]. It follows that M,v |= -'t:^x for each v G cc{w) = VP. Therefore, [[-'t:’^xl = fT, 
from which it follows that minj^?]] C [[-'t :^xl- Applying Theorem 5.16, we conclude that {M,w) satisfies 

B^H-.^X)- 


(eWCon) is valid: ^ t —)• -■?/). 

Suppose {M,w) satisfies t:^A. By the old proof, [[-'V'l = VP. So {M,w) satisfies 
(eA) is valid: \= t —)■ {B^ip —)■ t 

Suppose {M,w) satisfies and B^tp. Then w G A{t,p) and minjx]] C M. Conclusion: {M,w) 

satisfies t Ap. 


This completes the induction base. For the induction step, we must show that validity is preserved under 
the rules of (MP) and (eMN). The argument for (MP) is standard, so let us focus on (eMN). We assume |= p 
for the JCDL-derivable p (this is the “induction hypothesis”), and we prove that |= B^p. Proceeding, since 
1= p, it follows that [[(/jJ = VP and hence that rninj'^]] C [y?]]. By Certification (Definition |5.12[ A{ctp, p) = VP. 
But then {M,w) satisfies :'^p = B'^p. Soundness has been proved. 

Since JCDL is sound with respect to the class of well-ordered Fitting models we note that JCDL is 
consistent (i.e., Pjcdl T). In particular, take any pointed Fitting model {M,w) containing only the single 
world w. It is simple to construct such a model: take 

M ■■= {{w},{{w,w)},{{w,$)},A) , 
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where A is the “total” admissibility function defined by setting A(t, ip) := W for all (t, p ) G ^cdl x -^jcdl- 
It is obvious that the requisite properties from Definition 5.12 obtain. Since there is only one world, M is 
well-ordered. Further, by soundness, we have that Fjcdl P implies M, w \= ip. Therefore, since M, tc ^ T 
by Definition 5.13, it follows that Fjcdl T. That is, JCDL is consistent. We make use of this fact tacitly in 
what follows. 

For completeness, take a formula 9 such that F -i0. Define consistency, inconsistency, maximal consis¬ 
tency in (“maxcons in”) a set of formulas, the set sub(y?) of subformulas of p (including p itself), the set 
sub(5) containing all subformulas of each formula in the set S (including the formulas themselves), and the 
Boolean closure ©5 as in the old proof (but of course using the JCDL-conventions). For a set S of formulas, 
we define: 


BS:=SU{B^p \t:^pG S} , 

±S := SU{^p \ p G S} , 

BoS := S , 

Bi+iS ;= ±{B'^p \ Ip G S and p G BiS} , 
B.S:=Uo<i<.B^S , 

Co :=±5sub({0,T,T}) , 

Cl := ©Co , 

B := Bu}Ci , 

C;=CiUB , 

To ;= ±{t ■.'^p G .ifjcDL I t p G Co] ■ 


Key differences from the old proof: 

• the new operator BS adds the “certified version” B'^p = c^:^p of each formula tCp in S, 

• Co has been changed by adding the operator B, 

• every “'B ” in the old proof has been replaced by “B ”, 

• we use the JCDL-conventions (e.g., we are working in the language of JCDL), and 

• the set To (used later) is new. 

We then define: 

IF := {x C C I X is maxcons in C] , 

X := /\(x n Co) for X G IF , 
x'^ := {p I B^p G x} for X G IF and tp G Ci , 

< := {(x, y) G IF x IF | 3^^ G (x n y n Ci), C x} , 

F(x) := n X for X G IF , 

X := /\(x n To) for X G IF , 

A{t, p) := {x gW \ 3'p G .ifjcDL, b x t p] , 

M := (IF,<,F,^) . 

Key differences from the old proof: 

• every “i? ” in the old proof has been replaced by “B ”, 
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• the mapping taking a world x G VF to a formula x is new, 

• the function A of type (=^cdl x -S^jcdl) —t p{W) is new, and 

• M has been expanded to contain A. 

The arguments in the old proof (modulo the JCDL-conventions) are used to prove W is finite and 
nonempty, < is reflexive and transitive, < is total on each connected component, and < is well-founded. We 
prove the following result particular to the new proof: 

y € cc{x) => (Vt G Cl, t G x iff . (11) 

Proceeding, suppose y G cc(x). Since < is total on each connected component, we may assume without 
loss of generality that x < y. (The case where y < x is argued similarly.) Now x < y implies there exists 
6 G (x n y n Cl) such that y^ C x. For the left-to-right direction; suppose G x H Ci. If we had 

^ y, then it would follow by maximal consistency that G y, hence G y by (eNI), 

hence -if :'^(p G x by C x, thereby contradicting the consistency of x. So it must be the case that t G y 
after all. Now for the right-to-left direction: suppose t G y H Ci. It follows by (ePI) that B^{t G y. 
Since y^ C x, we obtain t G x. So ( [II| ) indeed obtains. 

In order to conclude that M is a Fitting model, we must prove that A satisfies the properties required 
of an admissibility function (Definition |5.12[ ). We state and prove these in turn. 

• Certification: A{cip,ip) = W. 

Take an arbitrary x G W. We have h x —)■ B'^ip by (Succ). Since B'^p = it follows that 

h X —)> Applying the definition of A, we obtain x G A{cp,ip). Since x G IT was chosen 

arbitrarily, we conclude that A{cp,ip) = IT. 

• Application; A{t, (pi —>■ (^ 2 ) C A(s, pi) C A{t ■ s, ^ 2 )- 

Assume x G A(t,pi —)■ P 2 ) C A(s,pi}. Applying the definition of A, this means there exists V’l £ 
-5 ?jcdl and 1/^2 G .i^jcDL such that h x —>■ —>■ P 2 ) and h x —>■ Now we have each of 

h —)> P 2 ) and h by (Succ) and modal reasoning. So it follows that 

h X ^ t (^1 ^ P2) A ^ ^2) A s :^Vi A . 

Applying (eA), we obtain 

hx^t ^P2 )As , 

from which it follows by (eK) that h x —)• (t • s) Applying the definition of A, it follows that 

X G A(t ■ s, p 2 )- 

• Sum: A(t, p) U A(s, p) C A{t + s, p). 

Suppose X G A{t, p) U A(s, p). Applying the definition of A, this means there exists 'ipt G -SfjcDL such 
that \- X ^ t p OT there exists ijjg G .i^jcDL such that h x —)> s Applying (eSum), it follows that 
h X —)• {t + s) :'^p for some ip G {'i/’t, i^s}- But then we obtain by the definition of A that x G A(t-|-s, p). 

• Admissibility Indefeasibility: if x G A{t, p) and y G cc(x), then y G A{t, p). 

Suppose X G A{t, p) and y G cc(x). It follows from x G A{t, p) by the definition of A that there exists 
iIj G .ifjcDL such that h x —)■ t:'^p. But y G cc(x), and so it follows by 0 that y = X. Therefore 
y ^ t:'^p, from which it follows by the definition of A that y G A(t, p). 
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So A satisfies the properties required of an admissibility function. 

Since W is nonempty, A satisfies the properties of an admissibility function, and < is a locally well- 
ordered, it follows that M is a locally well-ordered Fitting model. The arguments in the old proof (modulo 
the JCDL-conventions) are then used to prove that the Consistency Lemma holds and that the Minimality 
Lemma holds. 

By the old proof (modulo the JCDL-conventions), all of the induction base and step cases of the Truth 
Lemma hold, except for the induction step case for formulas t What remains is to check this remaining 
case. Before we do this, note: by the definition of Ci as the Boolean closure of Cq, it follows from t ip & Ci 
that t G Co and therefore t :'^ip G Tq. We now proceed with the argument. 


Induction step t :^ip (left to right): if x G IT and t :'^(p G x H Ci, then M, x \= t :‘^ip. 

Assume t :'^ip G x Cl Ci. By (eCert) and the definition of Ci, it follows that B'^ip G x n Ci. Using the 


old proof (modnlo the JCDL-conventions and nsing Theorem 5.16 in place of Theorem 3.4), we obtain 


M, X 1= B^(p. Also, since t :'^ip G x Cl Ci implies t G x Cl Tq, it follows that h x —)> t from which 
we obtai n x G A{t, tp) by the definition of A. So since x G A(t, p) and M, x \= B^p, it follows by 
that M, X \=t &p. 


Theorem 


5.14 


Induction step t :'^p (right to left): if x G IT, t :'^p G Ci, and M,x \= t :‘^p, then t :'^p G x. 

Assnme t ■.'^p G Ci and M, x \= t :'^p. By Theorem 5.14, it follows that M, x |= B'^p and x G A{t, p). 


Using the old proof (modulo the JCDL-conventions and using Theorem 5.16 in place of Theorem |3.4[ ), 
it follows from M,x |= B'^p that B'^p G X. Applying the definition of A, it follows from x G A{t, p) 
that there exists x £ -^jcdl such that h x —)■ t Ap. But then we have h x —)■ t Ap A B'^p. Applying 
(eA), we obtain \- x ^ t:^p. Since t:'^p G Ci implies t^p G Tq, it follows from \- x ^ t:^p hy the 
maximal consistency of x in C A Tq that t :'^p G x. 


This completes the proof of the Truth Lemma. We then apply the argnment as in the old proof (modulo 
the JCDL-conventions and using Theorem 5.18 in place of Theorem 3.6) to conclude that JCDL is complete 
with respect to the class of well-ordered Fitting models. □ 
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